K15159 : OpenSSL vulnerability CVE-2014-0160

Security Advisory Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. (CVE-2014-0160)

Impact

A malicious user can exploit vulnerable systems and retrieve information from memory. This information may potentially include user credentials or the private keys used for Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS). For information about vulnerable components or features, refer to the following list:

• Virtual servers using a Secure Sockets Layer (SSL) profile configured with the default Native SSL ciphers are not vulnerable. Only virtual servers using an SSL profile configured to use ciphers from the COMPAT SSL stack are vulnerable in BIG-IP 11.5.0 and 11.5.1. Additionally, virtual servers that do not use SSL profiles and pass SSL traffic to the back-end web servers will not protect the back-end resource servers.
• The Configuration utility and other services, such as iControl, are vulnerable.
• The big3d process included with BIG-IP GTM 11.5.0 and 11.5.1 is vulnerable. Additionally, monitored BIG-IP systems whosebig3d process was updated by an affected BIG-IP GTM system are also vulnerable.
• The big3d process included with Enterprise Manager 3.1.1 HF1 and HF2 is vulnerable. Additionally, monitored BIG-IP systems whosebig3d process was updated by an affected Enterprise Manager system are also vulnerable.
• The BIG-IP Edge Client for Android is not vulnerable. However, the BIG-IP Edge Client for Windows, Mac OS, and Linux is vulnerable. An attacker can retrieve sensitive information by using the stated vulnerability in the following scenarios:
  • User is tricked into connecting to any malicious SSL server.
  • User connects to a compromised FirePass or BIG-IP APM system.