PT-2014-3893 · Ibm · Ibm Websphere Datapower Appliances

Christopher Meyer + 2 · Published 2014-08-16 · Updated 2017-08-29 · CVE-2014-0852

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower SOA appliances versions 4.0.2.15 and earlier IBM WebSphere DataPower SOA appliances versions 5.x through 5.0.0.17 IBM WebSphere DataPower SOA appliances versions 6.0.0.x through 6.0.0.9 IBM WebSphere DataPower SOA appliances versions 6.0.1.x through 6.0.1.5

Description The issue makes it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an SSL/TLS side-channel timing attack.

Recommendations For versions 4.0.2.15 and earlier, update to a version later than 4.0.2.15. For versions 5.x through 5.0.0.17, update to a version later than 5.0.0.17. For versions 6.0.0.x through 6.0.0.9, update to a version later than 6.0.0.9. For versions 6.0.1.x through 6.0.1.5, update to a version later than 6.0.1.5.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-0852

Affected Products

Ibm Websphere Datapower Appliances

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg21678204 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT01111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0852 · Security Note
• http://secunia.com/advisories/60112 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90753 · Note