PT-2019-18191 · F5 · Big-Ip

Publicado 2019-04-15 · Atualizado 2020-08-24 · CVE-2019-6609

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP versions 12.1.1 HF2 through 12.1.4 BIG-IP versions 13.0.0 through 13.1.1.3 BIG-IP versions 14.0.0 through 14.1.0.1

Description This issue is a platform-dependent weakness that only impacts iSeries platforms. It affects the secure storage of the unit key, causing it to be stored in plaintext on disk instead of using the F5 hardware support. This also results in the unit key being stored in plaintext in UCS files taken on these platforms.

Recommendations For BIG-IP versions 12.1.1 HF2 through 12.1.4, update to a version that sets the secureKeyCapable attribute to utilize the F5 hardware support for secure unit key storage. For BIG-IP versions 13.0.0 through 13.1.1.3, update to a version that sets the secureKeyCapable attribute to utilize the F5 hardware support for secure unit key storage. For BIG-IP versions 14.0.0 through 14.1.0.1, update to a version that sets the secureKeyCapable attribute to utilize the F5 hardware support for secure unit key storage.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-6609

Produtos afetados

Big-Ip

Referências · 3

• https://support.f5.com/csp/article/K18535734 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6609 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6609 · Nota de Segurança