CVE-2014-8730
published 2014-12-10CVE-2014-8730: The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through…
PriorityP428medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
13.72%
96.1th percentile
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.
Affected
137 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_cisco3.4LOW
vendor_redhat3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
Padding-oracle attack on TLS CBC cipher mode
vendor_paloalto·2015-01-12·CVSS 4.3
CVE-2014-8730 [MEDIUM] CWE-310 Padding-oracle attack on TLS CBC cipher mode
Padding-oracle attack on TLS CBC cipher mode
A vulnerability affecting some implementations of TLS 1.x with CBC cipher modes has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions (CVE-2014-8730). This padding-oracle attack on TLS CBC cipher modes is a variant of the POODLE vulnerability, commonly known as “POODLE Bites”. This issue is confirmed to affect PAN-OS implementation of TLS 1.x. (Ref #72544)
The conditions of successful exploitation are similar to the POODLE and BEAST attacks, which require several conditions to be met for successful exploitation (i.e. the attacker requires a man-in-the-middle position in the network and must also be able to direct the victim client to send many repeated requests to the vulnerable server on behalf
Cisco
SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability
vendor_cisco·2014-12-11·CVSS 3.4
CVE-2014-8730 [LOW] CWE-20 SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability
SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability
A vulnerability in certain implementations of the TLSv1 protocol could allow an unauthenticated, remote attacker to access sensitive information.
The vulnerability is due to improper block cipher padding implemented in TLSv1 when using Cipher Block Chaining (CBC) mode. An attacker could exploit the vulnerability to perform an "oracle padding" side channel attack on the cryptographic message. A successful exploit could allow the attacker to access sensitive information.
Consult the bug release note for additional information about affected products and configurations.
F5 Networks has confirmed the vulnerability in a security advisory and released software updates.
Attacks exploiting this vulnera
Red Hat
TLS: incorrect check of padding bytes when using CBC cipher suites
vendor_redhat·2014-12-09·CVSS 3.4
CVE-2014-8730 [LOW] CWE-327 TLS: incorrect check of padding bytes when using CBC cipher suites
TLS: incorrect check of padding bytes when using CBC cipher suites
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identi
GHSA
GHSA-fr49-w774-hwch: The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10
ghsa_unreviewed·2022-05-17·CVSS 3.4
CVE-2014-8730 [LOW] GHSA-fr49-w774-hwch: The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable impl
No detection rules found.
No public exploits indexed.
http://marc.info/?l=bugtraq&m=144372772101168&w=2http://secunia.com/advisories/62167http://secunia.com/advisories/62224http://secunia.com/advisories/62388http://www-01.ibm.com/support/docview.wss?uid=swg21693271http://www-01.ibm.com/support/docview.wss?uid=swg21693337http://www-01.ibm.com/support/docview.wss?uid=swg21693495http://www.openwall.com/lists/oss-security/2014/12/09/27https://devcentral.f5.com/articles/cve-2014-8730-padding-issue-8151https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15882.htmlhttps://support.lenovo.com/product_security/poodlehttps://support.lenovo.com/us/en/product_security/poodlehttps://www.imperialviolet.org/2014/12/08/poodleagain.htmlhttp://marc.info/?l=bugtraq&m=144372772101168&w=2http://secunia.com/advisories/62167http://secunia.com/advisories/62224http://secunia.com/advisories/62388http://www-01.ibm.com/support/docview.wss?uid=swg21693271http://www-01.ibm.com/support/docview.wss?uid=swg21693337http://www-01.ibm.com/support/docview.wss?uid=swg21693495http://www.openwall.com/lists/oss-security/2014/12/09/27https://devcentral.f5.com/articles/cve-2014-8730-padding-issue-8151https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15882.htmlhttps://support.lenovo.com/product_security/poodlehttps://support.lenovo.com/us/en/product_security/poodlehttps://www.imperialviolet.org/2014/12/08/poodleagain.html
2014-12-10
Published