PT-2017-16912 · F5 · Big-Ip

Publicado 2017-12-21 · Atualizado 2018-01-09 · CVE-2017-6140

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.5.0 through 11.5.4 BIG-IP versions 11.6.0 through 11.6.1 BIG-IP versions 12.0.0 through 12.1.2

Description An undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services on certain BIG-IP devices.

Recommendations For versions 11.5.0 through 11.5.4, consider restricting access to Virtual Servers with client or server SSL profiles until a fix is available. For versions 11.6.0 through 11.6.1, consider disabling SSL profiles on Virtual Servers to minimize the risk of disruption. For versions 12.0.0 through 12.1.2, restrict the use of Virtual Servers with client or server SSL profiles to prevent data plane services disruption.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6140

Produtos afetados

Big-Ip

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6140 · Nota de Segurança
• http://securitytracker.com/id/1040042 · Nota
• https://osv.dev/vulnerability/CVE-2017-6140 · Aviso do Fabricante
• https://support.f5.com/csp/article/K55102452 · Aviso do Fabricante