Vulnerability CVE-2016-5022


Published: 2016-09-07

Description:
F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.x before 11.2.1 HF16 and 11.3.0; BIG-IP GTM 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, and 11.6.x before 11.6.1 HF1; BIG-IP PSM 11.2.x before 11.2.1 HF16, 11.3.x, and 11.4.0 through 11.4.1; Enterprise Manager 3.1.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 5.0.0; BIG-IQ Cloud and Orchestration 1.0.0; and iWorkflow 2.0.0, when Packet Filtering is enabled on virtual servers and possibly self IP addresses, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) and possibly have unspecified other impact via crafted network traffic.

Type:

CWE-284

(Improper Access Control)

Vendor: F5
Product: Big-iq centralized management 
Version: 4.6.0;
Product: Big-iq security 
Version:
4.5.0
4.4.0
4.3.0
4.2.0
4.1.0
4.0.0
See more versions on NVD
Product: Big-iq application delivery controller 
Version: 4.5.0;
Product: Big-iq device 
Version:
4.5.0
4.4.0
4.3.0
4.2.0
See more versions on NVD
Product: Big-iq cloud 
Version:
4.5.0
4.4.0
4.3.0
4.2.0
4.1.0
4.0.0
See more versions on NVD
Product: Enterprise manager 
Version: 3.1.1;
Product: F5 iworkflow 
Version: 2.0.0;
Product: Big-ip domain name system 
Version: 12.0.0;
Product: Big-ip advanced firewall manager 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
11.4.1
See more versions on NVD
Product: Big-ip access policy manager 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
11.4.1
See more versions on NVD
Product: Big-ip policy enforcement manager 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
11.4.1
See more versions on NVD
Product: Big-ip local traffic manager 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
11.4.1
See more versions on NVD
Product: Big-ip application security manager 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
See more versions on NVD
Product: Big-ip link controller 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
See more versions on NVD
Product: Big-ip application acceleration manager 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
11.4.1
See more versions on NVD
Product: Big-ip analytics 
Version:
12.0.0
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
11.4.1
See more versions on NVD
Product: Big-ip global traffic manager 
Version:
11.6.1
11.6.0
11.5.4
11.5.3
11.5.2
11.5.1
11.5.0
See more versions on NVD
Product: Big-ip protocol security module 
Version: 11.4.1;
Product: Big-ip protocol security manager 
Version: 11.4.1;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://www.securitytracker.com/id/1036709
http://www.securitytracker.com/id/1036710
https://support.f5.com/kb/en-us/solutions/public/k/06/sol06045217.html

Related CVE
CVE-2019-6659
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.
CVE-2019-6660
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
CVE-2019-6661
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.
CVE-2019-6662
On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data.
CVE-2019-6664
On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices.
CVE-2019-6656
BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-13.1.1.5, 12...
CVE-2019-6655
On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.
CVE-2019-6654
On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering (As defined in RFC 1812 section 5.3.7) on the control plane (management interface). This may allow attackers on a...

Copyright 2019, cxsecurity.com

 

Back to Top