PT-2019-18245 · F5 · F5 Big-Iq+3

Publicado 2019-11-15 · Atualizado 2019-11-19 · CVE-2019-6663

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.1 through 15.0.1 F5 BIG-IQ versions 5.2.0 through 7.0.0 F5 iWorkflow version 2.3.0 F5 Enterprise Manager version 3.1.1

Description The configuration utility is susceptible to an Anti DNS Pinning (DNS Rebinding) attack.

Recommendations For F5 BIG-IP versions 11.5.1 through 15.0.1, update the configuration to prevent DNS Rebinding attacks. For F5 BIG-IQ versions 5.2.0 through 7.0.0, restrict access to the configuration utility until a patch is available. For F5 iWorkflow version 2.3.0, consider disabling the vulnerable configuration options as a temporary workaround. For F5 Enterprise Manager version 3.1.1, avoid using the configuration utility until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-6663

Produtos afetados

F5 Big-Ip

F5 Big-Iq

F5 Enterprise Manager

F5 Iworkflow

Referências · 3

• https://support.f5.com/csp/article/K76052144 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6663 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6663 · Aviso do Fabricante