NVD

Id
35682  
Name
CVE-2014-8730  
Description
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-12-09  
Modified Date
2017-01-02  
Seq
2014-8730  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
182774 35682 CVE-2014-8730 HPSBPV03516  View
182775 35682 CVE-2014-8730 62167  View
182776 35682 CVE-2014-8730 62224  View
182777 35682 CVE-2014-8730 62388  View
182778 35682 CVE-2014-8730 http://www-01.ibm.com/support/docview.wss?uid=swg21693271  View
182779 35682 CVE-2014-8730 http://www-01.ibm.com/support/docview.wss?uid=swg21693337  View
182780 35682 CVE-2014-8730 http://www-01.ibm.com/support/docview.wss?uid=swg21693495  View
182781 35682 CVE-2014-8730 [oss-security] 20141209 Re: CVE question: Return of POODLE  View
182782 35682 CVE-2014-8730 https://devcentral.f5.com/articles/cve-2014-8730-padding-issue-8151  View
182783 35682 CVE-2014-8730 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635  View
182784 35682 CVE-2014-8730 https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15882.html  View
182785 35682 CVE-2014-8730 https://support.lenovo.com/product_security/poodle  View
182786 35682 CVE-2014-8730 https://support.lenovo.com/us/en/product_security/poodle  View
182787 35682 CVE-2014-8730 https://www.imperialviolet.org/2014/12/08/poodleagain.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16994 JVNDB-2014-005869 複数の F5 製品の SSL プロファイルコンポーネントにおける平文データを取得される脆弱性 複数の F5 製品の SSL プロファイルコンポーネントは、TLS (1.2 未満の 1.x) を使用する場合、接続終了時の CBC パディングバイトを適切にチェックしないため、平文データを取得される脆弱性が存在します。 CVE-2014-8730 76023 CVE-2014-8730 35682 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005869.html 2014-12-08 2015-03-03 View