PT-2016-1625 · F5 · Aam+7

Published 2016-01-12 · Updated 2016-01-15 · CVE-2015-7759

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM versions 12.0.0 through 12.0.0 before HF1

Description The issue is related to the Congestion Metrics Cache feature in the TCP profile for a virtual server, allowing remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets. This is connected to Path MTU (PMTU) discovery. The vulnerability exists due to insufficient input validation, which can be exploited by a remote attacker using specially crafted ICMP packets to cause a denial of service.

Recommendations For BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM versions 12.0.0 through 12.0.0 before HF1, consider disabling the Congestion Metrics Cache feature in the TCP profile for virtual servers as a temporary workaround until a patch is available. Restrict access to the vulnerable systems to minimize the risk of exploitation. Apply the HF1 patch to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00936

CVE-2015-7759

Affected Products

Aam

Afm

Apm

Asm

Analytics

Big-Ip Ltm

Link Controller

Pem

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-7759 · Security Note
• https://bdu.fstec.ru/vul/2016-00936 · Security Note
• https://support.f5.com/kb/en-us/solutions/public/k/22/sol22843911.html · Vendor Advisory
• http://securitytracker.com/id/1034627 · Note