Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.3252.2
Security updates for F5 Traffic Management Microkernel
5 April 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: F5 BIG-IP products
F5 Enterprise Manager
F5 BIG-IQ products
Publisher: F5 Networks
Operating System: Network Appliance
Virtualisation
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-6164 CVE-2017-6151 CVE-2017-6138
CVE-2017-6136 CVE-2017-6134 CVE-2017-6133
CVE-2017-6132
Original Bulletin:
https://support.f5.com/csp/article/K02714910
https://support.f5.com/csp/article/K12044607
https://support.f5.com/csp/article/K25033460
https://support.f5.com/csp/article/K37404773
https://support.f5.com/csp/article/K81137982
https://support.f5.com/csp/article/K34514540
https://support.f5.com/csp/article/K07369970
Comment: This bulletin contains seven (7) F5 Networks security advisories.
Revision History: April 5 2018: Update bulletins K02714910, K12044607,
K25033460, K37404773,
K34514540, K07369970
December 21 2017: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
K02714910:TLS vulnerability CVE-2017-6164
Security Advisory
Original Publication Date: 21 Dec, 2017
Latest Publication Date: 04 Apr, 2018
Security Advisory Description
In some circumstances, the Traffic Management Microkernel (TMM) does not
properly handle certain malformed TLS1.2 records, which allows remote
attackers to cause a denial-of-service (DoS) or possible remote command
execution on the BIG-IP system. (CVE-2017-6164)
Impact
A remote attacker may be able cause a denial of service (DoS) or possibly run
a command remotely on the BIG-IP system.
Security Advisory Status
F5 Product Development has assigned ID 684879 (BIG-IP) to this vulnerability.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if
your release is known to be vulnerable, the components or features that are
affected by the vulnerability, and for information about releases or hotfixes
that address the vulnerability, refer to the following table.
+-----------------+------+----------+----------+-----------+------+----------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IP |13.x |13.0.0 |13.1.0 | | | |
|(LTM, AAM, AFM, | | |13.0.1 | | | |
|Analytics, APM, +------+----------+----------+ | | |
|ASM, DNS, Edge |12.x |12.0.0 - |12.1.3 | | | |
|Gateway, | |12.1.2 | |High |8.1 |ClientSSL |
|GTM, Link +------+----------+----------+ | |profile |
|Controller, PEM, | |11.6.0 - | | | | |
|WebAccelerator, |11.x |11.6.1 |11.6.2 | | | |
|WebSafe) | |11.5.1 - |11.5.5 | | | |
| | |11.5.4 | | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|ARX |6.x |None |Not |Not |None |None |
| | | |applicable|vulnerable | | |
+-----------------+------+----------+----------+-----------+------+----------+
|Enterprise | | |Not |Not | | |
|Manager |3.x |None |applicable|vulnerable^|None |None |
| | | | |2 | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IQ | | |Not |Not | | |
|(Cloud, Device, |4.x |None |applicable|vulnerable |None |None |
|Security, ADC) | | | | | | |
+-----------------+------+----------+----------+-----------+------+----------+
| |5.x |None |Not | | | |
|BIG-IQ | | |applicable|Not | | |
|Centralized +------+----------+----------+vulnerable |None |None |
|Management |4.x |None |Not | | | |
| | | |applicable| | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IQ Cloud and |1.x |None |Not |Not |None |None |
|Orchestration | | |applicable|vulnerable | | |
+-----------------+------+----------+----------+-----------+------+----------+
|F5 iWorkflow |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable | | |
+-----------------+------+----------+----------+-----------+------+----------+
|LineRate |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable | | |
+-----------------+------+----------+----------+-----------+------+----------+
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC +------+----------+----------+vulnerable |None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+-----------------+------+----------+----------+-----------+------+----------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
^2 The specified products contain the affected code. However, F5 identifies
the vulnerability status as Not vulnerable because the attacker cannot exploit
the code in default, standard, or recommended configurations.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable
version, then no upgrade candidate currently exists.
Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.
Mitigation
None
Supplemental Information
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
o K13123: Managing BIG-IP product hotfixes (11.x - 13.x)
o K9502: BIG-IP hotfix matrix
- --------------------------------------------------------------------------------
K12044607:TMM vulnerability CVE-2017-6132
Security Advisory
Original Publication Date: 21 Dec, 2017
Latest Publication Date: 03 Apr, 2018
Security Advisory Description
Undisclosed sequence of packets sent to BIG-IP High Availability state mirror
listeners (primary and/or secondary IP) may cause TMM to restart. (
CVE-2017-6132)
Impact
The BIG-IP system may temporarily fail to process traffic as it recovers from
a TMM restart, and devices configured as a high-availability (HA) pair may
fail over.
Security Advisory Status
F5 Product Development has assigned ID 653993 (BIG-IP) to this vulnerability.
Additionally, BIG-IP iHealth may list Heuristic H12044607 on the Diagnostics >
Identified > High page.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if
your release is known to be vulnerable, the components or features that are
affected by the vulnerability, and for information about releases or hotfixes
that address the vulnerability, refer to the following table.
+------------------+------+----------+----------+----------+------+----------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
+------------------+------+----------+----------+----------+------+----------+
| |13.x |13.0.0 |13.1.0 | | | |
| | | |13.0.1 | | | |
|BIG-IP (LTM, AAM, +------+----------+----------+ | | |
|AFM, Analytics, |12.x |12.0.0 - |12.1.3 | | | |
|APM, ASM, DNS, | |12.1.2 | |High |7.5 |TMM |
|GTM, Link +------+----------+----------+ | | |
|Controller, PEM, | |11.6.0 - | | | | |
|WebSafe) |11.x |11.6.1 |11.6.2 | | | |
| | |11.5.0 - |11.5.5 | | | |
| | |11.5.4 | | | | |
+------------------+------+----------+----------+----------+------+----------+
|ARX |6.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|Enterprise Manager|3.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ (Cloud, | | |Not |Not | | |
|Device, Security, |4.x |None |applicable|vulnerable|None |None |
|ADC) | | | | | | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
|BIG-IQ Centralized| | |applicable|Not | | |
|Management +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ Cloud and |1.x |None |Not |Not |None |None |
|Orchestration | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|F5 iWorkflow |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|LineRate |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable
version, then no upgrade candidate currently exists.
Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.
Mitigation
To mitigate this vulnerability, you can configure a dedicated secure Virtual
Local Area Network (VLAN) for HA peer communications. For information, refer
to K14135: Defining network resources for BIG-IP HA features (11.x - 13.x).
Impact of action: Performing the suggested mitigation should not have a
negative impact on your system.
Supplemental Information
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
o K13123: Managing BIG-IP product hotfixes (11.x - 13.x)
o K9502: BIG-IP hotfix and point release matrix
- --------------------------------------------------------------------------------
K25033460:TMM vulnerability CVE-2017-6133
Security Advisory
Original Publication Date: 21 Dec, 2017
Latest Publication Date: 04 Apr, 2018
Security Advisory Description
Undisclosed HTTP requests may cause a denial of service (DoS). (CVE-2017-6133)
Impact
The Traffic Management Microkernel (TMM) generates a core file and restarts.
The BIG-IP system fails over to the peer device if configured as part of a
high availability (HA) device group.
Security Advisory Status
F5 Product Development has assigned ID 651221 (BIG-IP) and ID 655790 (F5
iWorkflow) to this vulnerability.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if
your release is known to be vulnerable, the components or features that are
affected by the vulnerability, and for information about releases or hotfixes
that address the vulnerability, refer to the following table.
+------------------+------+----------+----------+----------+------+----------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
+------------------+------+----------+----------+----------+------+----------+
| |13.x |13.0.0 |13.1.0 | | | |
|BIG-IP (LTM, AAM, | | |13.0.1 | | | |
|AFM, Analytics, +------+----------+----------+ | |TMM URI |
|APM, ASM, |12.x |12.1.0 - |12.1.3 |High |7.1 |parser |
|DNS, Link | |12.1.2 | | | |library |
|Controller, PEM, +------+----------+----------+ | | |
|WebSafe) |11.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IP (Edge | | |Not |Not | | |
|Gateway, GTM, PSM,|11.x |None |applicable|vulnerable|None |None |
|WebAccelerator) | | | | | | |
+------------------+------+----------+----------+----------+------+----------+
|ARX |6.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|Enterprise Manager|3.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ (Cloud, | | |Not |Not | | |
|Device, Security, |4.x |None |applicable|vulnerable|None |None |
|ADC) | | | | | | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
|BIG-IQ Centralized| | |applicable|Not | | |
|Management +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ Cloud and |1.x |None |Not |Not |None |None |
|Orchestration | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|F5 iWorkflow |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|LineRate |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable
version, then no upgrade candidate currently exists.
Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.
Mitigation
None
Supplemental Information
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
o K13123: Managing BIG-IP product hotfixes (11.x - 13.x)
o K9502: BIG-IP hotfix matrix
- --------------------------------------------------------------------------------
K37404773:TMM vulnerability CVE-2017-6134
Security Advisory
Original Publication Date: 21 Dec, 2017
Latest Publication Date: 03 Apr, 2018
Security Advisory Description
An undisclosed sequence of packets, sourced from an adjacent network may cause
TMM to crash. (CVE-2017-6134)
Impact
This issue is exposed in the default configuration. Traffic processing is
disrupted while the Traffic Management Microkernel (TMM) restarts. If the
affected F5 device is configured as part of a device group, the system will
trigger a failover to the peer device.
Security Advisory Status
F5 Product Development has assigned ID 655059 (BIG-IP), ID 658348 (BIG-IQ),
and ID 658341 (Enterprise Manager) to this vulnerability.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if
your release is known to be vulnerable, the components or features that are
affected by the vulnerability, and for information about releases or hotfixes
that address the vulnerability, refer to the following table.
+-----------------+------+----------+----------+-----------+------+----------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
+-----------------+------+----------+----------+-----------+------+----------+
| |13.x |13.0.0 |13.1.0 | | | |
|BIG-IP (LTM, AAM,| | |13.0.1 | | | |
|AFM, Analytics, +------+----------+----------+ | | |
|APM, ASM, DNS, |12.x |12.1.0 - |12.1.3 |Medium |6.5 |TMM |
|GTM, Link | |12.1.2 | | | | |
|Controller, PEM, +------+----------+----------+ | | |
|WebSafe) |11.x |11.5.1 - |11.6.2 | | | |
| | |11.6.1 |11.5.5 | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IP (Edge | | |Not |Not | | |
|Gateway, |11.x |None |applicable|vulnerable |None |None |
|WebAccelerator) | | | | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|ARX |6.x |None |Not |Not |None |None |
| | | |applicable|vulnerable | | |
+-----------------+------+----------+----------+-----------+------+----------+
|Enterprise |3.x |3.1.1 |None |Medium |6.5 |TMM |
|Manager | | | | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IQ (Cloud, | |4.4.0 - | | | | |
|Device, Security,|4.x |4.5.0 |None |Medium |6.5 |TMM |
|ADC) | | | | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IQ |5.x |5.0.0 - |None | | | |
|Centralized | |5.3.0 | |Medium |6.5 |TMM |
|Management +------+----------+----------+ | | |
| |4.x |4.6.0 |None | | | |
+-----------------+------+----------+----------+-----------+------+----------+
|BIG-IQ Cloud and |1.x |1.0.0 |None |Medium |6.5 |TMM |
|Orchestration | | | | | | |
+-----------------+------+----------+----------+-----------+------+----------+
| | | |Not |Not | | |
|F5 iWorkflow |2.x |None |applicable|vulnerable^|None |None |
| | | | |2 | | |
+-----------------+------+----------+----------+-----------+------+----------+
|LineRate |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable | | |
+-----------------+------+----------+----------+-----------+------+----------+
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC +------+----------+----------+vulnerable |None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+-----------------+------+----------+----------+-----------+------+----------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
^2 The specified products contain the affected code. However, F5 identifies
the vulnerability status as Not vulnerable because the attacker cannot exploit
the code in default, standard, or recommended configurations.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a
non-vulnerable version, then no upgrade candidate currently exists.
To determine the necessary upgrade path for your BIG-IQ system, you should
understand the BIG-IQ product offering name changes. For more information,
refer to K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow
systems.
Mitigation
None
Supplemental Information
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
- --------------------------------------------------------------------------------
K81137982: TMM vulnerability CVE-2017-6136
Security Advisory
Original Publication Date: Dec 21, 2017
Security Advisory Description
Undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast
Open and Tail Loss Probe options enabled in the associated TCP profile, may
cause a disruption of service to the Traffic Management Microkernel (TMM). (
CVE-2017-6136)
Impact
An attacker may be able to disrupt traffic or cause the BIG-IP system to fail
over to another device in the device group.
Note: The Fast Open and the Tail Loss Probe TCP profile options are both
disabled in the default configuration, and both options must be enabled to
expose this vulnerability.
Security Advisory Status
F5 Product Development has assigned ID 659791 (BIG-IP) to this vulnerability.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.
+-----------------------------------------------------------------------------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
|-------------------+------+----------+----------+----------+------+----------|
| |13.x |13.0.0 |13.1.0 | | | |
|BIG-IP (LTM, AAM, |------+----------+----------| | | |
|AFM, Analytics, |12.x |12.0.0 - |12.1.3 | | | |
|APM, ASM, DNS, GTM,| |12.1.2 | |Medium |5.9 |TMM |
|Link Controller, |------+----------+----------| | | |
|PEM, WebSafe) |11.x |None |Not | | | |
| | | |applicable| | | |
|-------------------+------+----------+----------+----------+------+----------|
|ARX |6.x |None |Not |Not | |None |
| | | |applicable|vulnerable| | |
|-------------------+------+----------+----------+----------+------+----------|
|Enterprise Manager |3.x |None |Not |Not | |None |
| | | |applicable|vulnerable| | |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ (Cloud, | | |Not |Not | | |
|Device, Security, |4.x |None |applicable|vulnerable| |None |
|ADC) | | | | | | |
|-------------------+------+----------+----------+----------+------+----------|
| |5.x |None |Not | | | |
|BIG-IQ Centralized | | |applicable|Not | | |
|Management |------+----------+----------|vulnerable| |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ Cloud and |1.x |None |Not |Not | |None |
|Orchestration | | |applicable|vulnerable| | |
|-------------------+------+----------+----------+----------+------+----------|
|F5 iWorkflow |2.x |None |Not |Not | |None |
| | | |applicable|vulnerable| | |
|-------------------+------+----------+----------+----------+------+----------|
|LineRate |2.x |None |Not |Not | |None |
| | | |applicable|vulnerable| | |
|-------------------+------+----------+----------+----------+------+----------|
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC |------+----------+----------|vulnerable| |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+-----------------------------------------------------------------------------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.
Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.
Mitigation
None
- --------------------------------------------------------------------------------
K34514540:TMM vulnerability CVE-2017-6138
Security Advisory
Original Publication Date: 21 Dec, 2017
Latest Publication Date: 04 Apr, 2018
Security Advisory Description
Malicious requests made to virtual servers with an HTTP profile can cause the
TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of
settings. The issue is also exposed with the non-default "normalize URI"
configuration options used in iRules and/or BIG-IP LTM policies. (
CVE-2017-6138)
Impact
An attacker may be able to disrupt traffic or cause the BIG-IP system to fail
over to another device in the device group. This vulnerability affects systems
with any of the following configurations:
o A virtual server associated with a BIG-IP APM profile.
o A virtual server associated with an HTTP profile and a local traffic
policy that has a rule condition with the HTTP URI and Use normalized URI
options enabled (the Use normalized URI option is disabled by default).
For example, in the following configuration excerpt, the local traffic
policy is vulnerable:
ltm policy /Common/K34514540 {
requires { http }
rules {
vulnerable {
conditions {
0 {
http-uri
path
normalized
values { /exploitable }
}
}
}
}
strategy /Common/first-match
}
o A virtual server associated with an HTTP profile and an iRule using any of
the following iRules commands with the -normalized switch:
HTTP::uri
HTTP::query
HTTP::path
For example:
when HTTP_REQUEST {
if { ([HTTP::uri -normalized] starts_with "/exploitable")} {
log local0.error "K34514540 URI example"
} elseif { ([HTTP::query -normalized] starts_with "/exploitable")} {
log local0.error "K34514540 Query example"
} elseif { ([HTTP::path -normalized] starts_with "/exploitable")} {
log local0.error "K34514540 Path example"
}
}
Security Advisory Status
F5 Product Development has assigned ID 662022 (BIG-IP) to this vulnerability.
Additionally, BIG-IP iHealth may list Heuristic H34514540 on the Diagnostics >
Identified > High page.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if
your release is known to be vulnerable, the components or features that are
affected by the vulnerability, and for information about releases or hotfixes
that address the vulnerability, refer to the following table.
+------------------+------+----------+----------+----------+------+----------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
+------------------+------+----------+----------+----------+------+----------+
| |13.x |13.0.0 |13.1.0 | | | |
|BIG-IP (LTM, AAM, | | |13.0.1 | | | |
|AFM, Analytics, +------+----------+----------+ | | |
|APM, ASM, DNS, |12.x |12.1.0 - |12.1.3 |High |7.5 |TMM |
|GTM, Link | |12.1.2 | | | | |
|Controller, PEM, +------+----------+----------+ | | |
|WebSafe) |11.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
|ARX |6.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|Enterprise Manager|3.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ (Cloud, | | |Not |Not | | |
|Device, Security, |4.x |None |applicable|vulnerable|None |None |
|ADC) | | | | | | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
|BIG-IQ Centralized| | |applicable|Not | | |
|Management +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ Cloud and |1.x |None |Not |Not |None |None |
|Orchestration | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|F5 iWorkflow |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|LineRate |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable
version, then no upgrade candidate currently exists.
Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.
Mitigation
To mitigate this vulnerability, you should avoid using:
o the normalize option with L7 policies.
o the -normalize option with HTTP::uri, HTTP::query, or HTTP::path iRules
commands.
Impact of action: The impact of the suggested mitigation depends on the
specific environment. F5 recommends testing any such changes during a
maintenance window with consideration to the possible impact on your specific
environment.
Supplemental Information
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
- --------------------------------------------------------------------------------
K07369970:TMM vulnerability CVE-2017-6151
Security Advisory
Original Publication Date: 21 Dec, 2017
Latest Publication Date: 03 Apr, 2018
Security Advisory Description
Undisclosed requests made to BIG-IP virtual servers that use the "HTTP/2
profile" may result in a disruption of service to TMM. (CVE-2017-6151)
Impact
An attacker may be able to disrupt traffic or cause the BIG-IP system to fail
over to another device in the device group. This vulnerability affects the
BIG-IP system when virtual servers are configured with an HTTP/2 profile.
Security Advisory Status
F5 Product Development has assigned ID 668501 (BIG-IP) to this vulnerability.
Additionally, BIG-IP iHealth may list Heuristic H07369970 on the Diagnostics >
Identified > High page.
To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if
your release is known to be vulnerable, the components or features that are
affected by the vulnerability, and for information about releases or hotfixes
that address the vulnerability, refer to the following table.
+------------------+------+----------+----------+----------+------+----------+
| | |Versions |Fixes | |CVSSv3|Vulnerable|
|Product |Branch|known to |introduced|Severity |score^|component |
| | |be |in | |1 |or feature|
| | |vulnerable| | | | |
+------------------+------+----------+----------+----------+------+----------+
| | | |13.1.0 | | | |
|BIG-IP (LTM, AAM, |13.x |13.0.0 |13.0.1 | | | |
|AFM, Analytics, | | | | | |TMM |
|APM, ASM, DNS, +------+----------+----------+ | |(virtual |
|Edge Gateway, |12.x |None |12.1.3.2 |High |7.5 |servers |
|GTM, Link | | | | | |with HTTP/|
|Controller, PEM, +------+----------+----------+ | |2 profile)|
|WebAccelerator, | | |Not | | | |
|WebSafe) |11.x |None |applicable| | | |
| | | | | | | |
+------------------+------+----------+----------+----------+------+----------+
|ARX |6.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|Enterprise Manager|3.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ (Cloud, | | |Not |Not | | |
|Device, Security, |4.x |None |applicable|vulnerable|None |None |
|ADC) | | | | | | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
|BIG-IQ Centralized| | |applicable|Not | | |
|Management +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
|BIG-IQ Cloud and |1.x |None |Not |Not |None |None |
|Orchestration | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|F5 iWorkflow |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
|LineRate |2.x |None |Not |Not |None |None |
| | | |applicable|vulnerable| | |
+------------------+------+----------+----------+----------+------+----------+
| |5.x |None |Not | | | |
| | | |applicable|Not | | |
|Traffix SDC +------+----------+----------+vulnerable|None |None |
| |4.x |None |Not | | | |
| | | |applicable| | | |
+------------------+------+----------+----------+----------+------+----------+
^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable
version, then no upgrade candidate currently exists.
Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.
Mitigation
None
Supplemental Information
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWsVjGox+lLeg9Ub1AQjFphAAg6xIPL6d4XkATHMviASsYLuAOT+QzgOT
grBMLMUQSrwHB9u/4dQp9Ue6hGvWAS6o0qT4/HCOSJQ+1Jwb5+39lrO+FBO2jlt2
rxkrXB04ZwoYXTJXN/QrhaBCdGYfwyGPHvRtXNZkMkm6ZUUjfBvqvXTQfDd+BvnI
F3P9Mz7G+8VHfpAvBk9Y3+hfp5f/0du532LMKZzaVSRxXO7NNtk1Avtdo3Qhv55C
1pq+B+ZwUQGY5JUDc1412h/RgE4fkIJI9cvW+6xed2qtQ1gV1ps2h8QtyAr33Y60
wAAdbmo2lxVLWMj/lxlq9OWLda8cwyKyIUhEwf25tqeSWm2P9RiKw4sln9Myhadj
dGChOO8Wr9mb+LKpsYpxeo87E2/FlqXXIho4bkbxJ6XMLEhSRSWDEVa7+3HdrlpM
O4VPFtbX26rLm43/T8TwzvOGlXypmHYQzB692ZNj/aZ51tZZsK8ooO7n2CkGNYpW
Z0TAAWNTFzC9j9bogCOxd6kh2ElfcpLHojN/QOdZr4mHjcKZg7n06ou53PpcFpcS
JrdQhyu7xu28OpZNJCzVW8aiSHmSjSg4yVT75sexV6CW5Re3GyPncmhWj142aD2p
qJkeNnNBbfTViCi7QpJZGY4J/sG+zlpb2FkNXtTafT7Npfn0N4Z/GHIEbP9teQWQ
uR6dpDaqqgM=
=32I2
-----END PGP SIGNATURE-----