ESB-2017.0111.2 - UPDATE [Appliance] F5 products: Denial of service - Remote/unauthenticated 2017-11-02

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2017.0111.2
        K86272821: BIND vulnerability CVE-2016-9131 and K40181790:
                     BIND vulnerability CVE-2016-9444
                              2 November 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           F5 products
Publisher:         F5 Networks
Operating System:  Network Appliance
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-9444 CVE-2016-9131 

Reference:         ESB-2017.0097
                   ESB-2017.0094
                   ESB-2017.0088
                   ESB-2017.0087

Original Bulletin: 
   https://support.f5.com/csp/article/K86272821
   https://support.f5.com/csp/article/K40181790

Comment: This bulletin contains two (2) F5 Networks security advisories.

Revision History:  November  2 2017: Patch released
                   January  13 2017: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

K86272821: BIND vulnerability CVE-2016-9131

Security Advisory

Original Publication Date: Jan 13, 2017
Updated Date: Nov 01, 2017

Applies to (see versions):

  o Product: BIG-IQ, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC,
    BIG-IQ Centralized Management
      5.3.0, 5.2.0, 5.1.0, 5.0.0, 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0,
      4.0.0
  o Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM,
    BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link
    Controller, BIG-IP LTM, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator
      13.0.0, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.2, 11.6.1, 11.6.0, 11.5.5,
      11.5.4, 11.5.3, 11.5.2, 11.5.1, 11.5.0, 11.4.1, 11.4.0, 11.2.1
  o Product: Enterprise Manager
      3.1.1
  o Product: F5 iWorkflow
      2.3.0, 2.2.0, 2.1.0, 2.0.2, 2.0.1, 2.0.0
  o Product: LineRate
      2.6.1, 2.6.0, 2.5.2, 2.5.1, 2.5.0
  o Product: ARX, ARX
      6.4.0, 6.3.0, 6.2.0
  o Product: F5 WebSafe
      1.0.0
  o Product: Traffix SDC
      5.1.0, 4.4.0, 4.0.5, 4.0.2, 4.0.0
  o Product: BIG-IQ Cloud and Orchestration
      1.0.0

Security Advisory Description

named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x
before 9.11.0-P2 allows remote attackers to cause a denial of service
(assertion failure and daemon exit) via a malformed response to an RTYPE ANY
query. (CVE-2016-9131)

Impact

When the BIND recursion option is enabled, an attacker may exploit this
vulnerability to cause the named process to restart. Additionally, the
restarted process does not trigger the BIG-IP system high availability (HA)
failover event.

By default, the BIND recursion option is not enabled on BIG-IP DNS or GTM
systems. If the BIND recursion option is enabled, BIG-IP DNS or GTM systems are
vulnerable.

Security Advisory Status

F5 Product Development has assigned ID 636699 (BIG-IP) to this vulnerability.

To determine if your release is known to be vulnerable, the components or
features that are affected by the vulnerability, and for information about
releases or hotfixes that address the vulnerability, refer to the following
table:

+---------------+---------------+-----------------+-----------+---------------+
|               |Versions known |Versions known to|           |Vulnerable     |
|Product        |to be          |be not vulnerable|Severity   |component or   |
|               |vulnerable     |                 |           |feature        |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |13.0.0 HF1       |           |               |
|               |13.0.0         |12.1.2 HF1       |           |               |
|               |12.0.0 - 12.1.2|11.6.2           |           |               |
|               |11.4.1 - 11.6.1|11.5.4 HF3       |           |               |
|               |11.4.0 HF3 and |11.4.0 - 11.4.0  |           |               |
|BIG-IP LTM     |later          |HF2              |High       |BIND           |
|               |11.3.0 HF7 and |11.3.0 - 11.3.0  |           |               |
|               |later          |HF6              |           |               |
|               |11.2.1 HF9 and |11.0.0 - 11.2.1  |           |               |
|               |later          |HF8              |           |               |
|               |               |10.1.0 - 10.2.4  |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP AAM     |11.4.1 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.4.0 HF3 and |11.5.4 HF3       |           |               |
|               |later          |11.4.0 - 11.4.0  |           |               |
|               |               |HF2              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP AFM     |11.4.1 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.4.0 HF3 and |11.5.4 HF3       |           |               |
|               |later          |11.4.0 - 11.4.0  |           |               |
|               |               |HF2              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|               |11.4.1 - 11.6.1|11.6.2           |           |               |
|               |11.4.0 HF3 and |11.5.4 HF3       |           |               |
|BIG-IP         |later          |11.4.0 - 11.4.0  |High       |BIND           |
|Analytics      |11.3.0 HF7 and |HF2              |           |               |
|               |later          |11.3.0 - 11.3.0  |           |               |
|               |11.2.1 HF9 and |HF6              |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|               |11.4.1 - 11.6.1|11.6.2           |           |               |
|               |11.4.0 HF3 and |11.5.4 HF3       |           |               |
|BIG-IP APM     |later          |11.4.0 - 11.4.0  |High       |BIND           |
|               |11.3.0 HF7 and |HF2              |           |               |
|               |later          |11.3.0 - 11.3.0  |           |               |
|               |11.2.1 HF9 and |HF6              |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|               |11.4.1 - 11.6.1|11.6.2           |           |               |
|               |11.4.0 HF3 and |11.5.4 HF3       |           |               |
|BIG-IP ASM     |later          |11.4.0 - 11.4.0  |High       |BIND           |
|               |11.3.0 HF7 and |HF2              |           |               |
|               |later          |11.3.0 - 11.3.0  |           |               |
|               |11.2.1 HF9 and |HF6              |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP DNS     |13.0.0         |13.0.0 HF1       |High       |BIND           |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP Edge    |11.2.1 HF9 and |11.2.1 - 11.2.1  |High       |BIND           |
|Gateway        |later          |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |11.6.2           |           |               |
|               |11.4.1 - 11.6.1|11.5.4 HF3       |           |               |
|               |11.4.0 HF3 and |11.4.0 - 11.4.0  |           |               |
|               |later          |HF2              |           |               |
|BIG-IP GTM     |11.3.0 HF7 and |11.3.0 - 11.3.0  |High       |BIND           |
|               |later          |HF6              |           |               |
|               |11.2.1 HF9 and |11.0.0 - 11.2.1  |           |               |
|               |later          |HF8              |           |               |
|               |               |10.1.0 - 10.2.4  |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |13.0.0 HF1       |           |               |
|               |13.0.0         |12.1.2 HF1       |           |               |
|               |12.0.0 - 12.1.2|11.6.2           |           |               |
|               |11.4.1 - 11.6.1|11.5.4 HF3       |           |               |
|BIG-IP Link    |11.4.0 HF3 and |11.4.0 - 11.4.0  |           |               |
|Controller     |later          |HF2              |High       |BIND           |
|               |11.3.0 HF7 and |11.3.0 - 11.3.0  |           |               |
|               |later          |HF6              |           |               |
|               |11.2.1 HF9 and |11.0.0 - 11.2.1  |           |               |
|               |later          |HF8              |           |               |
|               |               |10.1.0 - 10.2.4  |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|11.6.2           |           |               |
|BIG-IP PEM     |11.4.1 - 11.6.1|12.1.2 HF1       |High       |BIND           |
|               |11.4.0 HF3 and |11.5.4 HF3       |           |               |
|               |later          |11.4.0 - 11.4.0  |           |               |
|               |               |HF2              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |11.4.1         |11.4.0 - 11.4.0  |           |               |
|BIG-IP PSM     |11.4.0 HF3 and |HF2              |High       |BIND           |
|               |later          |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP         |11.2.1 HF9 and |11.2.1 - 11.2.1  |High       |BIND           |
|WebAccelerator |later          |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |                 |           |               |
|BIG-IP WebSafe |12.0.0 - 12.1.2|11.6.2           |High       |BIND           |
|               |11.6.0 - 11.6.1|                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|ARX            |None           |6.2.0 - 6.4.0    |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|Enterprise     |               |                 |Not        |               |
|Manager        |None           |3.1.1            |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Cloud   |None           |4.0.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Device  |None           |4.2.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Security|None           |4.0.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ ADC     |None           |4.5.0            |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IQ         |               |5.0.0 - 5.3.0    |Not        |               |
|Centralized    |None           |4.6.0            |vulnerable^|None           |
|Management     |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IQ Cloud   |               |                 |Not        |               |
|and            |None           |1.0.0            |vulnerable^|None           |
|Orchestration  |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|F5 iWorkflow   |None           |2.0.0 - 2.3.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|LineRate       |None           |2.5.0 - 2.6.1    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|Traffix SDC    |None           |4.0.0 - 5.1.0    |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+

^1 The specified products contain the affected code. However, F5 identifies the
vulnerability status as Not vulnerable because the attacker cannot exploit the
code in default, standard, or recommended configurations.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a
non-vulnerable version, then no upgrade candidate currently exists.

Mitigation

To mitigate this vulnerability, you can use an iRule to drop client RTYPE=ANY
queries.

Impact of action: The impact of the suggested mitigation will depend on the
specific environment. F5 recommends that you test any such changes during a
maintenance window and consider the possible impact on your specific
environment.

Supplemental Information

  o K17329: BIG-IP GTM name has changed to BIG-IP DNS
  o K9970: Subscribing to email notifications regarding F5 products
  o K9957: Creating a custom RSS feed to view new and updated documents
  o K4602: Overview of the F5 security vulnerability response policy
  o K4918: Overview of the F5 critical issue hotfix policy
  o K167: Downloading software and firmware from F5
  o K13123: Managing BIG-IP product hotfixes (11.x - 13.x)
  o K9502: BIG-IP hotfix matrix

==============================================================================

Final - K40181790: BIND vulnerability CVE-2016-9444

Security Advisory

Original Publication Date: Jan 13, 2017
Updated Date: Nov 01, 2017

Applies to (see versions):

  o Product: BIG-IQ, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC,
    BIG-IQ Centralized Management
      5.1.0, 5.0.0, 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0
  o Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM,
    BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link
    Controller, BIG-IP LTM, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator
      13.0.0, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.2, 11.6.1, 11.6.0, 11.5.5,
      11.5.4, 11.5.3, 11.5.2, 11.5.1, 11.5.0, 11.4.1, 11.4.0, 11.2.1
  o Product: Enterprise Manager
      3.1.1
  o Product: F5 iWorkflow
      2.0.2, 2.0.1, 2.0.0
  o Product: LineRate
      2.6.1, 2.6.0, 2.5.2, 2.5.1, 2.5.0
  o Product: ARX, ARX
      6.4.0, 6.3.0, 6.2.0
  o Product: F5 WebSafe
      1.0.0
  o Product: Traffix SDC
      5.1.0, 4.4.0, 4.0.5, 4.0.2, 4.0.0
  o Product: BIG-IQ Cloud and Orchestration
      1.0.0

The security issue described in this article has been resolved or does not
affect any F5 products. There will be no further updates, unless new
information is discovered.

Security Advisory Description

named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x
before 9.11.0-P2 allows remote attackers to cause a denial of service
(assertion failure and daemon exit) via a crafted DS resource record in an
answer. (CVE-2016-9444)

Impact

When the BIND recursion option is enabled, an attacker may exploit this
vulnerability to cause the named process to restart. Additionally, the
restarted process does not trigger the BIG-IP system high availability (HA)
failover event.

By default, the BIND recursion option is not enabled on BIG-IP DNS or GTM
systems. If the BIND recursion option is enabled, BIG-IP DNS or GTM systems are
vulnerable.

Security Advisory Status

F5 Product Development has assigned ID 636702 (BIG-IP) to this vulnerability.

To determine if your release is known to be vulnerable, the components or
features that are affected by the vulnerability, and for information about
releases or hotfixes that address the vulnerability, refer to the following
table:

+---------------+---------------+-----------------+-----------+---------------+
|               |Versions known |Versions known to|           |Vulnerable     |
|Product        |to be          |be not vulnerable|Severity   |component or   |
|               |vulnerable     |                 |           |feature        |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP LTM     |11.3.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.2.1 HF9 and |11.5.4 HF3       |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|BIG-IP AAM     |12.0.0 - 12.1.2|12.1.2 HF1       |High       |BIND           |
|               |11.4.0 - 11.6.1|11.6.2           |           |               |
|               |               |11.5.4 HF3       |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|BIG-IP AFM     |12.0.0 - 12.1.2|12.1.2 HF1       |High       |BIND           |
|               |11.4.0 - 11.6.1|11.6.2           |           |               |
|               |               |11.5.4 HF3       |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP         |11.3.0 - 11.6.1|11.6.2           |High       |BIND           |
|Analytics      |11.2.1 HF9 and |11.5.4 HF3       |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP APM     |11.3.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.2.1 HF9 and |11.5.4 HF3       |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP ASM     |11.3.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.2.1 HF9 and |11.5.4 HF3       |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP DNS     |13.0.0         |13.0.0 HF1       |High       |BIND           |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP Edge    |11.2.1 HF9 and |11.2.1 - 11.2.1  |High       |BIND           |
|Gateway        |later          |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |11.3.0 - 11.6.1|11.6.2           |           |               |
|BIG-IP GTM     |11.2.1 HF9 and |11.5.4 HF3       |High       |BIND           |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP Link    |11.3.0 - 11.6.1|11.6.2           |High       |BIND           |
|Controller     |11.2.1 HF9 and |11.5.4 HF3       |           |               |
|               |later          |11.2.1 - 11.2.1  |           |               |
|               |               |HF8              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|BIG-IP PEM     |12.0.0 - 12.1.2|12.1.2 HF1       |High       |BIND           |
|               |11.4.0 - 11.6.1|11.6.2           |           |               |
|               |               |11.5.4 HF3       |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |11.3.0 - 11.4.1|11.2.1 - 11.2.1  |           |               |
|BIG-IP PSM     |11.2.1 HF9 and |HF8              |High       |BIND           |
|               |later          |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP         |11.3.0         |11.2.1 - 11.2.1  |           |               |
|WebAccelerator |11.2.1 HF9 and |HF8              |High       |BIND           |
|               |later          |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|BIG-IP WebSafe |12.0.0 - 12.1.2|12.1.2 HF1       |High       |BIND           |
|               |11.6.0 - 11.6.1|11.6.2           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|ARX            |None           |6.2.0 - 6.4.0    |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|Enterprise     |               |                 |Not        |               |
|Manager        |None           |3.1.1            |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Cloud   |None           |4.0.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Device  |None           |4.2.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Security|None           |4.0.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ ADC     |None           |4.5.0            |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IQ         |               |5.0.0 - 5.1.0    |Not        |               |
|Centralized    |None           |4.6.0            |vulnerable^|None           |
|Management     |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IQ Cloud   |               |                 |Not        |               |
|and            |None           |1.0.0            |vulnerable^|None           |
|Orchestration  |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|F5 iWorkflow   |None           |2.0.0            |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|LineRate       |None           |2.5.0 - 2.6.1    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|Traffix SDC    |None           |4.0.0 - 5.1.0    |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+

^1 The specified products contain the affected code. However, F5 identifies the
vulnerability status as Not vulnerable because the attacker cannot exploit the
code in default, standard, or recommended configurations.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a
non-vulnerable version, then no upgrade candidate currently exists.

Mitigation

To mitigate this vulnerability, you can disable the recursion option on the
BIND configuration if it is not required in your environment. To do so, perform
the following procedure.

Impact of action: This procedure disables the recursion feature in the BIND
configuration and restarts the system service that may affect the BIG-IP system
responding to DNS queries. F5 recommends that you perform this procedure during
a scheduled maintenance period.

 1. Log in to the Advanced Shell (bash) of the BIG-IP system as the root user.
 2. Check if the system has recursion enabled for the named service by typing
    the following command:

    grep "recursion\ " /var/named/config/named.conf

    If the output displays "recursion yes," proceed to step 4.

 3. Check if the system has recursion enabled for the dnscached service
    by typing the following command:

    grep "recursion\ " /var/dnscached/config/named.conf

    If the output displays "recursion yes," proceed to step 4.

    Note: The /var/dnscached/config/named.conf configuration file is valid only
    if the BIG-IP system is provisioned or was previously provisioned with the
    BIG-IP APM module.

 4. Use an editor of your choice to remove the following lines from the target
    configuration file:

    recursion yes;
    allow-recursion { <IP-Addresses-ACL> };

    If you have more than one file to edit, after evaluating the files in step
    2 and step 3, repeat step 4 for the next configuration file.

 5. If you have modified the configuration of the dnscached service in step 4,
    you must restart the dnscached service by typing the following command:

    tmsh restart /sys service dnscached

 6. If you have modified the configuration of the named service in step 4, you
    must restart the named service by typing the following command:

    tmsh restart /sys service named

Supplemental Information

  o K9970: Subscribing to email notifications regarding F5 products
  o K9957: Creating a custom RSS feed to view new and updated documents
  o K4602: Overview of the F5 security vulnerability response policy
  o K4918: Overview of the F5 critical issue hotfix policy
  o K167: Downloading software and firmware from F5
  o K13123: Managing BIG-IP product hotfixes (11.x - 13.x)
  o K9502: BIG-IP hotfix matrix

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWfq1Oox+lLeg9Ub1AQgcAg/7BQY9edBkFb5x7HxnKsMNfO79tZaRHsYy
nGnOBJVvf24xWeikULfDy937jogtKzQsIbaE+bq6oTZEYz7Cqmhp+bedqv3OO3c6
Vh2hzNPzieqqTver6XBMP6msdPBwJsZ7WARcjrKPB5DEpc8/PTwR52/0wQXHD9il
vCsbSSTZTdbEg3l6JUiVkgZEdnb1ivIchRH8YvQZdZRJFJmqfDjncdSj59YU5Mr+
BSIrsrS/IguVANUebcrEgpJPvycdtcUpvfGliPtr499v7/1/vEusWA9PM+LLkNSc
UPrKKpriqeLslQUNAeWc3n/emrbYoVSK4HwEiOXBIxJC6WTVuCVygd0P4XKQ6liR
QzWkqW4gdST4tbvTPgxNNVlWtraBFI0x1BblqmgctxwdEb4OiX4HaSWMB0NU+Y03
EgVr5jinY5eLdXp4p9At3bGa8cwGpRWiS1inyhlDzHvNLl1iTxy4Jb6lQ+PAYwV3
l3W+Q/lXCnE+eGLtgfNm8eXHwwVuliULavMpNNAGFC7FqNgbmLOVMAiktKZxVLJO
OQX1EY7DpIv/+f2QdQUt7O58Si97sHJ4XIrt4WkV8blWLi0AMDgkSPe3urR7wV5E
ukVdYW/eM2LHhkXLfXCIcOGZf/SteT20HCNdm7EjvGVahC0X39bKlFS2Gs/VHQNH
zwQsCO4I86I=
=OIwn
-----END PGP SIGNATURE-----

« Back to bulletins