PT-2017-9192 · F5 · F5 Big-Ip Apm

Publicado 2017-04-11 · Atualizado 2017-07-12 · CVE-2016-7467

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 11.5.4 through 11.5.4 HF2 F5 BIG-IP APM versions 11.6.0 through 11.6.1 HF1 F5 BIG-IP APM versions 12.0.0 through 12.1.1

Description The TMM SSO plugin in F5 BIG-IP APM, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector.

Recommendations For F5 BIG-IP APM versions 11.5.4 through 11.5.4 HF2, update to a version outside of this range to resolve the issue. For F5 BIG-IP APM versions 11.6.0 through 11.6.1 HF1, update to a version outside of this range to resolve the issue. For F5 BIG-IP APM versions 12.0.0 through 12.1.1, update to a version outside of this range to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-7467

Produtos afetados

F5 Big-Ip Apm

Referências · 5

• http://securityfocus.com/bid/97168 · Nota
• https://osv.dev/vulnerability/CVE-2016-7467 · Aviso do Fabricante
• https://support.f5.com/csp/article/K95444512 · Aviso do Fabricante
• http://securitytracker.com/id/1038131 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7467 · Nota de Segurança