F5 Networks BIG-IP : OpenSSL vulnerability (K15159) (Heartbleed)
high Nessus Plugin ID 78164
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote device is missing a vendor-supplied security patch.Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. (CVE-2014-0160)Impact
A malicious user can exploit vulnerable systems and retrieve information from memory. This information may potentially include user credentials or the private keys used for Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS). For information about vulnerable components or features, refer to the following list :
Virtual servers using aSecure Sockets Layer (SSL) profile configured with the default Native SSL ciphers are not vulnerable. Only virtual servers using an SSL profile configured to use ciphers from the COMPAT SSL stack are vulnerable in BIG-IP 11.5.0 and 11.5.1. Additionally, virtual servers that do not use SSL profiles and pass SSL traffic to the back-end web servers will not protect the back-end resource servers.
The Configuration utility and other services, such as iControl, are vulnerable.
The big3d process included with BIG-IP GTM 11.5.0 and 11.5.1 is vulnerable. Additionally, monitored BIG-IP systems whose big3d process was updated by an affected BIG-IP GTM system are also vulnerable.
The big3d process included with Enterprise Manager 3.1.1 HF1 and HF2 is vulnerable. Additionally, monitored BIG-IP systems whose big3d process was updated by an affected Enterprise Manager system are also vulnerable.
The BIG-IP Edge Client for Android is not vulnerable. However, the BIG-IP Edge Client for Windows, Mac OS, and Linux is vulnerable. An attacker can retrieve sensitive information by using the stated vulnerability in the following scenarios: User is tricked into connecting to any malicious SSL server.
User connects to a compromised FirePass or BIG-IP APM system.
Solution
Upgrade to one of the non-vulnerable versions listed in the F5 Solution K15159.See Also
Plugin Details
Severity: High
ID: 78164
File Name: f5_bigip_SOL15159.nasl
Version: 1.9
Type: local
Published: 10/10/2014
Updated: 3/10/2021
Dependencies: f5_bigip_detect.nbin
Configuration: Enable paranoid mode
Risk Information
VPR
Risk Factor: High
Score: 7.3
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 8.2
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:N
Temporal Vector: E:ND/RL:OF/RC:C
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/h:f5:big-ip
Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/16/2015
Vulnerability Publication Date: 4/7/2014
Exploitable With
Core Impact
Reference Information
CVE: CVE-2014-0160
BID: 66690