PT-2020-18847 · F5 · F5 Big-Ip

Published 2020-12-11 · Updated 2020-12-16 · CVE-2020-5949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.0 through 13.1.3.4 F5 BIG-IP versions 14.0.0 through 14.0.1

Description A certain traffic pattern sent to a virtual server configured with an FTP profile can cause the FTP channel to break.

Recommendations For F5 BIG-IP versions 13.1.0 through 13.1.3.4, consider restricting access to the FTP profile until a patch is available. For F5 BIG-IP versions 14.0.0 through 14.0.1, consider restricting access to the FTP profile until a patch is available. As a temporary workaround, consider disabling the FTP profile on virtual servers to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-5949

Affected Products

F5 Big-Ip

References · 13

• https://osv.dev/vulnerability/CVE-2020-5949 · Vendor Advisory
• https://support.f5.com/csp/article/K20984059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5949 · Security Note
• https://t.me/cibsecurity/20482 · Telegram Post
• https://t.me/cibsecurity/20613 · Telegram Post
• https://t.me/cibsecurity/20593 · Telegram Post
• https://t.me/cibsecurity/20574 · Telegram Post
• https://t.me/cibsecurity/20501 · Telegram Post
• https://t.me/cybersecuritytechnologies/2306 · Telegram Post
• https://t.me/cibsecurity/20633 · Telegram Post
• https://t.me/cibsecurity/20541 · Telegram Post
• https://t.me/cibsecurity/20521 · Telegram Post
• https://t.me/cibsecurity/20554 · Telegram Post