PT-2017-16920 · F5 · F5 Big-Ip

Publicado 2017-10-27 · Atualizado 2017-11-16 · CVE-2017-6161

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP software versions 11.2.1, 11.4.0 through 11.5.4, 11.6.0 through 11.6.1, 12.0.0 through 12.1.2

Description The issue allows attackers on adjacent networks to bypass TLS protections, potentially leading to a denial-of-service (DoS) attack via resource exhaustion when ConfigSync is configured. This could affect connections to mcpd.

Recommendations For versions 11.2.1, consider disabling ConfigSync to prevent exploitation until a fix is available. For versions 11.4.0 through 11.5.4, restrict access to mcpd to minimize the risk of resource exhaustion. For versions 11.6.0 through 11.6.1, avoid using ConfigSync until the issue is resolved. For versions 12.0.0 through 12.1.2, consider implementing additional security measures to prevent adjacent network attacks.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2017-6161

Produtos afetados

F5 Big-Ip

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-6161 · Aviso do Fabricante
• http://securitytracker.com/id/1039675 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6161 · Nota de Segurança
• http://securitytracker.com/id/1039676 · Nota
• http://securityfocus.com/bid/101636 · Nota
• https://support.f5.com/csp/article/K62279530 · Aviso do Fabricante