CVE-2014-9326: Medium severity f5 big-ip application acceleration manager vulnerability
The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the (2) Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 does not properly validate server SSL certificates, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9326?
CVE-2014-9326 has a CVSS score indicating a high severity, potentially allowing exploitation by unauthenticated attackers.
How do I fix CVE-2014-9326?
To fix CVE-2014-9326, update affected F5 BIG-IP products to the latest patched version as recommended by F5.
What products are affected by CVE-2014-9326?
CVE-2014-9326 affects multiple F5 BIG-IP products including LTM, AAM, AFM, and others, specifically versions between 11.5.0 and 11.6.0.
What is the nature of the vulnerability in CVE-2014-9326?
CVE-2014-9326 is related to the automatic signature update feature, which may allow attackers to exploit the system.
Can CVE-2014-9326 be exploited remotely?
Yes, CVE-2014-9326 can potentially be exploited remotely due to its nature of affecting update functionalities within the system.