PT-2016-3871 · F5 · F5 Big-Ip Apm+5

Publicado 2016-04-11 · Atualizado 2016-04-18 · CVE-2015-8240

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM versions prior to 11.4.1 HF10 F5 BIG-IP LTM versions 11.5.x prior to 11.5.4 F5 BIG-IP LTM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP AAM versions prior to 11.4.1 HF10 F5 BIG-IP AAM versions 11.5.x prior to 11.5.4 F5 BIG-IP AAM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP AFM versions prior to 11.4.1 HF10 F5 BIG-IP AFM versions 11.5.x prior to 11.5.4 F5 BIG-IP AFM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP Analytics versions prior to 11.4.1 HF10 F5 BIG-IP Analytics versions 11.5.x prior to 11.5.4 F5 BIG-IP Analytics versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP APM versions prior to 11.4.1 HF10 F5 BIG-IP APM versions 11.5.x prior to 11.5.4 F5 BIG-IP APM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP ASM versions prior to 11.4.1 HF10 F5 BIG-IP ASM versions 11.5.x prior to 11.5.4 F5 BIG-IP ASM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP GTM versions prior to 11.4.1 HF10 F5 BIG-IP GTM versions 11.5.x prior to 11.5.4 F5 BIG-IP GTM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP Link Controller versions prior to 11.4.1 HF10 F5 BIG-IP Link Controller versions 11.5.x prior to 11.5.4 F5 BIG-IP Link Controller versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP PEM versions prior to 11.4.1 HF10 F5 BIG-IP PEM versions 11.5.x prior to 11.5.4 F5 BIG-IP PEM versions 11.6.x prior to 11.6.0 HF6 F5 BIG-IP PSM versions prior to 11.4.1 HF10

Description The Traffic Management Microkernel (TMM) in F5 BIG-IP does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.

Recommendations For F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM versions prior to 11.4.1 HF10, update to version 11.4.1 HF10 or later. For F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM versions 11.5.x prior to 11.5.4, update to version 11.5.4 or later. For F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM versions 11.6.x prior to 11.6.0 HF6, update to version 11.6.0 HF6 or later. For F5 BIG-IP PSM versions prior to 11.4.1 HF10, update to version 11.4.1 HF10 or later.

Correção

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

CVE-2015-8240

Produtos afetados

F5 Big-Ip Apm

F5 Big-Ip Analytics

F5 Big-Ip Gtm

F5 Big-Ip Ltm

F5 Big-Ip Link Controller

F5 Big-Ip Pem

Referências · 3

• http://securitytracker.com/id/1035367 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8240 · Nota de Segurança
• https://support.f5.com/kb/en-us/solutions/public/k/06/sol06223540.html · Aviso do Fabricante