PT-2018-8293 · F5 · F5 Big-Ip Advanced Firewall Manager

Publicado 2018-01-19 · Atualizado 2018-02-06 · CVE-2017-6142

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Advanced Firewall Manager versions 11.6.0 through 11.6.2 F5 BIG-IP Advanced Firewall Manager versions 12.1.0 through 12.1.2 F5 BIG-IP Advanced Firewall Manager version 13.0.0

Description The issue concerns the incorrect implementation of X509 certificate verification in the "user id" feature of the F5 BIG-IP Advanced Firewall Manager. This results in the failure to properly validate the remote server's identity.

Recommendations For versions 11.6.0 through 11.6.2, update the certificate verification mechanism to properly validate the remote server's identity. For versions 12.1.0 through 12.1.2, update the certificate verification mechanism to properly validate the remote server's identity. For version 13.0.0, update the certificate verification mechanism to properly validate the remote server's identity.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-6142

Produtos afetados

F5 Big-Ip Advanced Firewall Manager

Referências · 4

• http://securitytracker.com/id/1040255 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6142 · Nota de Segurança
• https://support.f5.com/csp/article/K20682450 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6142 · Aviso do Fabricante