PT-2021-15335 · F5 · F5 Big-Ip

Published 2021-04-30 · Updated 2021-05-19 · CVE-2021-23008

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 11.6.6, 12.1.6, 13.1.4, 14.1.4, and 15.1.3 F5 BIG-IP versions 16.0.x

Description The issue allows BIG-IP APM AD authentication to be bypassed via a spoofed AS-REP response sent over a hijacked KDC connection or from an AD server compromised by an attacker. This can be used to bypass Kerberos security and sign into the Big-IP Access Policy Manager or admin console.

Recommendations For versions 11.6.x, update to version 11.6.6 or later. For versions 12.1.x, update to version 12.1.6 or later. For versions 13.1.x, update to version 13.1.4 or later. For versions 14.1.x, update to version 14.1.4 or later. For versions 15.1.x, update to version 15.1.3 or later. For versions 16.0.x, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-23008

Affected Products

F5 Big-Ip

References · 6

• https://support.f5.com/csp/article/K51213246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23008 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23008 · Vendor Advisory
• https://t.me/malwr/5056 · Telegram Post
• https://t.me/sysadm_in_channel/3031 · Telegram Post
• https://t.me/cybersecuritytechnologies/3261 · Telegram Post