PT-2017-9196 · F5 · Psm+9

Publicado 2017-05-11 · Atualizado 2019-06-06 · CVE-2016-7476

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe versions 11.3.0 through 11.4.1 HF9 F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe versions 11.5.0 through 11.5.3 HF1 F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe versions 11.6.0 through 11.6.0 HF5

Description The issue is related to a memory leak in the Traffic Management Microkernel (TMM) when handling certain types of TCP traffic. This can be exploited by remote attackers to cause a denial of service (DoS) using a crafted TCP packet.

Recommendations For versions 11.3.0 through 11.4.1 HF9, update to version 11.4.1 HF10 or later. For versions 11.5.0 through 11.5.3 HF1, update to version 11.5.3 HF2 or later. For versions 11.6.0 through 11.6.0 HF5, update to version 11.6.0 HF6 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-7476

Produtos afetados

Aam

Afm

Apm

Asm

Big-Ip Ltm

Gtm

Link Controller

Pem

Psm

Websafe

Referências · 5

• https://osv.dev/vulnerability/CVE-2016-7476 · Aviso do Fabricante
• http://securitytracker.com/id/1037274 · Nota
• http://securityfocus.com/bid/94353 · Nota
• https://support.f5.com/csp/#/article/K87416818 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7476 · Nota de Segurança