CVE-2014-8587

SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/
https://twitter.com/SAP_Gsupport/status/522401681997570048
http://service.sap.com/sap/support/notes/2067859
http://secunia.com/advisories/57606

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:sap:commoncryptolib::::::::
	cpe:2.3:a:sap:sapcrytolib::::::::
	cpe:2.3:a:sap:sapseculib:-:::::::*

OR	cpe:2.3:a:sap:netweaver::::::::
	cpe:2.3:a:sap:hana:-:::::::*

Information

Published : 2014-11-04 07:55

Updated : 2015-02-03 21:08

NVD link : CVE-2014-8587

Mitre link : CVE-2014-8587

JSON object : View

CWE

CWE-310

Cryptographic Issues

Products Affected

sap

hana
sapseculib
commoncryptolib
sapcrytolib
netweaver

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/", "name": "http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/", "tags": [], "refsource": "MISC"}, {"url": "https://twitter.com/SAP_Gsupport/status/522401681997570048", "name": "https://twitter.com/SAP_Gsupport/status/522401681997570048", "tags": [], "refsource": "CONFIRM"}, {"url": "http://service.sap.com/sap/support/notes/2067859", "name": "http://service.sap.com/sap/support/notes/2067859", "tags": [], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/57606", "name": "57606", "tags": [], "refsource": "SECUNIA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-8587", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-11-04T15:55Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sap:commoncryptolib:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "8.4.29"}, {"cpe23Uri": "cpe:2.3:a:sap:sapcrytolib:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.555.37"}, {"cpe23Uri": "cpe:2.3:a:sap:sapseculib:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sap:netweaver:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sap:hana:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2015-02-04T05:08Z"}

7.5 /10