PT-2013-5924 · F5 · F5 Big-Ip Edge Gateway+8

Published 2013-10-26 · Updated 2017-08-29 · CVE-2013-6016

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM versions 10.0.0 through 10.2.2 and 11.0.0 F5 BIG-IP APM versions 10.0.0 through 10.2.2 and 11.0.0 F5 BIG-IP ASM versions 10.0.0 through 10.2.2 and 11.0.0 F5 BIG-IP Edge Gateway versions 10.0.0 through 10.2.2 and 11.0.0 F5 BIG-IP GTM versions 10.0.0 through 10.2.2 and 11.0.0 F5 BIG-IP Link Controller versions 10.0.0 through 10.2.2 and 11.0.0 F5 BIG-IP WOM versions 10.0.0 through 10.2.2 and 11.0.0 F5 Analytics version 11.0.0 F5 PSM versions 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.4.1 F5 WebAccelerator versions 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.3.0

Description The issue allows remote attackers to cause a denial of service via unspecified vectors, potentially leading to a SIGFPE or assertion failure and TMM restart, by changing a TCP connection to the ESTABLISHED state before receiving the ACK packet.

Recommendations For F5 BIG-IP LTM versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 BIG-IP APM versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 BIG-IP ASM versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 BIG-IP Edge Gateway versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 BIG-IP GTM versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 BIG-IP Link Controller versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 BIG-IP WOM versions 10.0.0 through 10.2.2 and 11.0.0, consider disabling the TMM until a patch is available. For F5 Analytics version 11.0.0, consider disabling the TMM until a patch is available. For F5 PSM versions 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.4.1, consider disabling the TMM until a patch is available. For F5 WebAccelerator versions 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.3.0, consider disabling the TMM until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-6016

Affected Products

F5 Analytics

F5 Big-Ip Apm

F5 Big-Ip Edge Gateway

F5 Big-Ip Gtm

F5 Big-Ip Ltm

F5 Big-Ip Link Controller

F5 Big-Ip Wom

F5 Psm

F5 Webaccelerator

References · 5

• http://support.f5.com/kb/en-us/solutions/public/13000/200/sol13233.html · Vendor Advisory
• http://secunia.com/advisories/55378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6016 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88166 · Note
• http://securitytracker.com/id/1029220 · Note