Lucene search

[email protected]CVE-2014-4024

HistoryMar 19, 2018 - 9:29 p.m.

CVE-2014-4024

2018-03-1921:29:00

CWE-200

[email protected]

web.nvd.nist.gov

f5 big-ip

ssl virtual servers

cve-2014-4024

vulnerability

nvd

security

timing side-channel attack

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.9 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

65.6%

JSON

SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack.

Affected configurations

NVD

Node

f5big-ip_local_traffic_managerRange10.0.0–10.2.4

f5big-ip_local_traffic_managerRange11.0.0–11.5.1

Node

f5big-ip_application_acceleration_managerRange11.4.0–11.5.1

Node

f5big-ip_advanced_firewall_managerRange11.3.0–11.5.1

Node

f5big-ip_analyticsRange11.0.0–11.5.1

Node

f5big-ip_access_policy_managerRange10.1.0–10.2.4

f5big-ip_access_policy_managerRange11.0.0–11.5.1

Node

f5big-ip_application_security_managerRange10.0.0–10.2.4

f5big-ip_application_security_managerRange11.0.0–11.5.1

Node

f5big-ip_edge_gatewayRange10.1.0–10.2.4

f5big-ip_edge_gatewayRange11.0.0–11.3.0

Node

f5big-ip_global_traffic_managerRange10.0.0–10.2.4

f5big-ip_global_traffic_managerRange11.0.0–11.5.1

Node

f5big-ip_link_controllerRange10.0.0–10.2.4

f5big-ip_link_controllerRange11.0.0–11.5.1

Node

f5big-ip_policy_enforcement_managerRange11.3.0–11.5.1

Node

f5big-ip_protocol_security_moduleRange10.0.0–10.2.4

f5big-ip_protocol_security_moduleRange11.0.0–11.4.1

Node

f5big-ip_webacceleratorRange10.0.0–10.2.4

f5big-ip_webacceleratorRange11.0.0–11.3.0

Node

f5big-ip_wan_optimization_managerRange10.0.0–10.2.4

f5big-ip_wan_optimization_managerRange11.0.0–11.3.0

CPENameOperatorVersion
f5:big-ip_local_traffic_managerf5 big-ip local traffic managerle10.2.4
f5:big-ip_local_traffic_managerf5 big-ip local traffic managerle11.5.1

CPE	Name	Operator	Version
f5:big-ip_local_traffic_manager	f5 big-ip local traffic manager	le	10.2.4
f5:big-ip_local_traffic_manager	f5 big-ip local traffic manager	le	11.5.1

References

exchange.xforce.ibmcloud.com/vulnerabilities/95834

support.f5.com/csp/article/K15500

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.9 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

65.6%

JSON

Related for CVE-2014-4024

nessus1 nvd1 prion1 f52 cvelist1