var-201411-0218
Vulnerability from variot
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors. Multiple SAP products are prone to to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks, disclose sensitive information and perform unauthorized actions. This may aid in further attacks. The following products are vulnerable: Versions prior to SAP SAPCRYPTOLIB 5.555.38 Versions prior to SAP SAPSECULIB 8.4.30 Versions prior to SAP CommonCryptoLib 8.4.30
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201411-0218", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "sapseculib", scope: "eq", trust: 1.6, vendor: "sap", version: null, }, { model: "netweaver", scope: "eq", trust: 1, vendor: "sap", version: "*", }, { model: "sapcryptolib", scope: "lte", trust: 1, vendor: "sap", version: "5.555.37", }, { model: "commoncryptolib", scope: "lte", trust: 1, vendor: "sap", version: "8.4.29", }, { model: "hana", scope: "eq", trust: 1, vendor: "sap", version: null, }, { model: "commoncryptolib", scope: "eq", trust: 0.9, vendor: "sap", version: "8.4.29", }, { model: "commoncryptolib", scope: "lt", trust: 0.8, vendor: "sap", version: "8.4.30", }, { model: "hana", scope: null, trust: 0.8, vendor: "sap", version: null, }, { model: "netweaver", scope: null, trust: 0.8, vendor: "sap", version: null, }, { model: "sapcryptolib", scope: "lt", trust: 0.8, vendor: "sap", version: "5.555.38", }, { model: "sapseculib", scope: "lt", trust: 0.8, vendor: "sap", version: "8.4.30", }, { model: "sapcrytolib", scope: "eq", trust: 0.6, vendor: "sap", version: "5.555.37", }, { model: "sapseculib", scope: "eq", trust: 0.3, vendor: "sap", version: "8.4.29", }, { model: "sapseculib", scope: "eq", trust: 0.3, vendor: "sap", version: "0", }, { model: "sapcryptolib", scope: "eq", trust: 0.3, vendor: "sap", version: "5.555.37", }, { model: "sapcryptolib", scope: "eq", trust: 0.3, vendor: "sap", version: "0", }, { model: "netweaver abap", scope: "eq", trust: 0.3, vendor: "sap", version: "0", }, { model: "hana", scope: "eq", trust: 0.3, vendor: "sap", version: "0", }, { model: "commoncryptolib", scope: "eq", trust: 0.3, vendor: "sap", version: "0", }, { model: "sapseculib", scope: "ne", trust: 0.3, vendor: "sap", version: "8.4.30", }, { model: "sapcryptolib", scope: "ne", trust: 0.3, vendor: "sap", version: "5.555.38", }, { model: "commoncryptolib", scope: "ne", trust: 0.3, vendor: "sap", version: "8.4.30", }, ], sources: [ { db: "BID", id: "71027", }, { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "NVD", id: "CVE-2014-8587", }, { db: "CNNVD", id: "CNNVD-201411-043", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:sap:commoncryptolib:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "8.4.29", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:sap:sapcryptolib:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "5.555.37", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:sap:sapseculib:-:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:sap:hana:-:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:sap:netweaver:*:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], cpe_match: [], operator: "AND", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2014-8587", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "SAP", sources: [ { db: "BID", id: "71027", }, ], trust: 0.3, }, cve: "CVE-2014-8587", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, impactScore: 6.4, integrityImpact: "PARTIAL", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "HIGH", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "Partial", baseScore: 7.5, confidentialityImpact: "Partial", exploitabilityScore: null, id: "CVE-2014-8587", impactScore: null, integrityImpact: "Partial", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "High", trust: 0.8, userInteractionRequired: null, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, ], cvssV3: [], severity: [ { author: "NVD", id: "CVE-2014-8587", trust: 1.8, value: "HIGH", }, { author: "CNNVD", id: "CNNVD-201411-043", trust: 0.6, value: "HIGH", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "NVD", id: "CVE-2014-8587", }, { db: "CNNVD", id: "CNNVD-201411-043", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors. Multiple SAP products are prone to to a security vulnerability that may allow attackers to conduct spoofing attacks. \nAn attacker can exploit this issue to conduct spoofing attacks, disclose sensitive information and perform unauthorized actions. This may aid in further attacks. \nThe following products are vulnerable:\nVersions prior to SAP SAPCRYPTOLIB 5.555.38\nVersions prior to SAP SAPSECULIB 8.4.30\nVersions prior to SAP CommonCryptoLib 8.4.30", sources: [ { db: "NVD", id: "CVE-2014-8587", }, { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "BID", id: "71027", }, ], trust: 1.89, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2014-8587", trust: 2.7, }, { db: "SECUNIA", id: "57606", trust: 1.6, }, { db: "JVNDB", id: "JVNDB-2014-005218", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201411-043", trust: 0.6, }, { db: "BID", id: "71027", trust: 0.3, }, ], sources: [ { db: "BID", id: "71027", }, { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "NVD", id: "CVE-2014-8587", }, { db: "CNNVD", id: "CNNVD-201411-043", }, ], }, id: "VAR-201411-0218", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VARIoT devices database", id: null, }, ], trust: 0.27111164, }, last_update_date: "2023-12-18T12:38:08.069000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "SAP Security Note 2067859", trust: 0.8, url: "http://scn.sap.com/docs/doc-55451", }, { title: "Potential Exposure to Digital Signature Spoofing #ABAP #Netweaver #SAP Note 2067859 http://ow.ly/CMsqF", trust: 0.8, url: "https://twitter.com/sap_gsupport/status/522401681997570048", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-005218", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-310", trust: 1.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "NVD", id: "CVE-2014-8587", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.7, url: "http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing/", }, { trust: 1.9, url: "http://service.sap.com/sap/support/notes/2067859", }, { trust: 1.6, url: "http://secunia.com/advisories/57606", }, { trust: 1.6, url: "https://twitter.com/sap_gsupport/status/522401681997570048", }, { trust: 0.8, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-8587", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-8587", }, { trust: 0.3, url: "http://www.saphana.com/welcome", }, { trust: 0.3, url: "http://scn.sap.com/community/netweaver-portal", }, ], sources: [ { db: "BID", id: "71027", }, { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "NVD", id: "CVE-2014-8587", }, { db: "CNNVD", id: "CNNVD-201411-043", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "BID", id: "71027", }, { db: "JVNDB", id: "JVNDB-2014-005218", }, { db: "NVD", id: "CVE-2014-8587", }, { db: "CNNVD", id: "CNNVD-201411-043", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2014-10-15T00:00:00", db: "BID", id: "71027", }, { date: "2014-11-06T00:00:00", db: "JVNDB", id: "JVNDB-2014-005218", }, { date: "2014-11-04T15:55:07.310000", db: "NVD", id: "CVE-2014-8587", }, { date: "2014-11-05T00:00:00", db: "CNNVD", id: "CNNVD-201411-043", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2014-10-15T00:00:00", db: "BID", id: "71027", }, { date: "2014-11-06T00:00:00", db: "JVNDB", id: "JVNDB-2014-005218", }, { date: "2023-10-03T15:48:10.677000", db: "NVD", id: "CVE-2014-8587", }, { date: "2014-11-05T00:00:00", db: "CNNVD", id: "CNNVD-201411-043", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-201411-043", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "SAP NetWeaver AS ABAP and SAP HANA Used in SAPCRYPTOLIB In products such as DSA Vulnerability that is forged as a signature", sources: [ { db: "JVNDB", id: "JVNDB-2014-005218", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "encryption problem", sources: [ { db: "CNNVD", id: "CNNVD-201411-043", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.