PT-2015-4183 · F5 · F5 Big-Ip Apm+5

Publicado 2015-05-12 · Atualizado 2017-01-03 · CVE-2014-9326

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller versions 11.5.0 through 11.6.0 F5 BIG-IP ASM versions 10.0.0 through 11.6.0 F5 BIG-IP PEM versions 11.3.0 through 11.6.0

Description The issue arises from the automatic signature update functionality in the Phone Home and Call Home features, which fails to properly validate server SSL certificates. This allows remote attackers to conduct man-in-the-middle attacks by using a crafted certificate.

Recommendations For F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller versions 11.5.0 through 11.6.0, consider disabling the Phone Home feature until a patch is available. For F5 BIG-IP ASM versions 10.0.0 through 11.6.0, consider disabling both the Phone Home and Call Home features until a patch is available. For F5 BIG-IP PEM versions 11.3.0 through 11.6.0, consider disabling the Call Home feature until a patch is available.

Correção

Identificadores relacionados

CVE-2014-9326

Produtos afetados

F5 Big-Ip Apm

F5 Big-Ip Analytics

F5 Big-Ip Gtm

F5 Big-Ip Ltm

F5 Big-Ip Link Controller

F5 Big-Ip Pem

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-9326 · Nota de Segurança
• https://support.f5.com/kb/en-us/solutions/public/16000/000/sol16090.html · Aviso do Fabricante
• http://securitytracker.com/id/1032305 · Nota