PT-2016-1061 · F5 · Asm+8

Published 2016-01-12 · Updated 2016-01-14 · CVE-2015-8611

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM versions 12.0.0 through 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms

Description The issue is related to errors in synchronizing passwords with the Always-On Management (AOM) subsystem. This might allow remote attackers to obtain login access to AOM via an expired or default password.

Recommendations For BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM versions 12.0.0 through 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms, apply the HF1 hotfix to properly sync passwords with the AOM subsystem and prevent potential unauthorized access. At the moment, there is no information about additional mitigation measures.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

BDU:2016-00129

CVE-2015-8611

Affected Products

Aam

Afm

Apm

Asm

Analytics

Big-Ip Ltm

Dns

Link Controller

Pem

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-8611 · Security Note
• https://support.f5.com/kb/en-us/solutions/public/k/05/sol05272632.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00129 · Security Note
• http://securitytracker.com/id/1034629 · Note