PT-2017-16912 · F5 · Big-Ip

Published 2017-12-21 · Updated 2018-01-09 · CVE-2017-6140

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.5.0 through 11.5.4 BIG-IP versions 11.6.0 through 11.6.1 BIG-IP versions 12.0.0 through 12.1.2

Description An undisclosed sequence of packets sent to Virtual Servers with client or server SSL profiles may cause disruption of data plane services on certain BIG-IP devices.

Recommendations For versions 11.5.0 through 11.5.4, consider restricting access to Virtual Servers with client or server SSL profiles until a fix is available. For versions 11.6.0 through 11.6.1, consider disabling SSL profiles on Virtual Servers to minimize the risk of disruption. For versions 12.0.0 through 12.1.2, restrict the use of Virtual Servers with client or server SSL profiles to prevent data plane services disruption.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6140

Affected Products

Big-Ip

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6140 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6140 · Vendor Advisory
• https://support.f5.com/csp/article/K55102452 · Vendor Advisory
• http://securitytracker.com/id/1040042 · Note