Denial-of-Service Risk in F5 BIG-IP Software by F5 Networks
CVE-2017-6164

8.1HIGH

Key Information:

Vendor
F5
Status
Big-ip Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe
Vendor
CVE Published:
21 December 2017

Summary

The problem arises in F5 BIG-IP software versions 13.0.0, 12.0.0 through 12.1.2, and 11.6.0 through 11.6.1 where the Traffic Management Microkernel (TMM) fails to correctly process specific malformed TLS1.2 records. This mishandling could permit remote attackers to execute a denial-of-service attack or even initiate remote command execution on the affected BIG-IP system, posing serious risks to system integrity and availability.

Affected Version(s)

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe 13.0.0

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe 12.0.0 - 12.1.2

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe 11.6.0 - 11.6.1

References

http://www.securitytracker.com/id/1040054
vdb-entryx_refsource_SECTRACK
https://support.f5.com/csp/article/K02714910
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.