PT-2016-1061 · F5 · Asm+8

Publicado 2016-01-12 · Atualizado 2016-01-14 · CVE-2015-8611

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM versions 12.0.0 through 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms

Description The issue is related to errors in synchronizing passwords with the Always-On Management (AOM) subsystem. This might allow remote attackers to obtain login access to AOM via an expired or default password.

Recommendations For BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM versions 12.0.0 through 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms, apply the HF1 hotfix to properly sync passwords with the AOM subsystem and prevent potential unauthorized access. At the moment, there is no information about additional mitigation measures.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

BDU:2016-00129

CVE-2015-8611

Produtos afetados

Aam

Afm

Apm

Asm

Analytics

Big-Ip Ltm

Dns

Link Controller

Pem

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-8611 · Nota de Segurança
• https://support.f5.com/kb/en-us/solutions/public/k/05/sol05272632.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00129 · Nota de Segurança
• http://securitytracker.com/id/1034629 · Nota