ESB-2017.2820 - [Appliance] F5 Products: Denial of service - Remote/unauthenticated 2017-11-03

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.2820
                K80533167: BIND vulnerability CVE-2017-3135
                              3 November 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           F5 Products
Publisher:         F5 Networks
Operating System:  Network Appliance
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-3135  

Reference:         ESB-2017.1445
                   ESB-2017.0528
                   ESB-2017.0525
                   ESB-2017.0459
                   ESB-2017.0454
                   ESB-2017.0379

Original Bulletin: 
   https://support.f5.com/csp/article/K80533167

- --------------------------BEGIN INCLUDED TEXT--------------------

K80533167: BIND vulnerability CVE-2017-3135

Security Advisory

Original Publication Date: Feb 23, 2017
Updated Date: Nov 02, 2017

Applies to (see versions):

  o Product: BIG-IQ, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC,
    BIG-IQ Centralized Management
      5.1.0, 5.0.0, 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 4.0.0
  o Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM,
    BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link
    Controller, BIG-IP LTM, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator
      13.0.0, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.2, 11.6.1, 11.6.0, 11.5.4,
      11.5.3, 11.5.2, 11.5.1, 11.5.0, 11.4.1, 11.2.1
  o Product: Enterprise Manager
      3.1.1
  o Product: F5 iWorkflow
      2.0.2, 2.0.1, 2.0.0
  o Product: LineRate
      2.6.1, 2.6.0, 2.5.2, 2.5.1, 2.5.0
  o Product: ARX, ARX
      6.4.0, 6.3.0, 6.2.0
  o Product: F5 WebSafe
      1.0.0
  o Product: Traffix SDC
      5.1.0, 4.4.0, 4.0.5, 4.0.2, 4.0.0
  o Product: BIG-IQ Cloud and Orchestration
      1.0.0

Security Advisory Description

** RESERVED ** This candidate has been reserved by an organization or
individual that will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.
(CVE-2015-3135)

BIG-IP configurations using DNS64 (the DNS IPv6 to IPv4 option configured in
the DNS profile) and Response Policy Zone (RPZ) rewriting (in the BIND
configuration) together are affected by this CVE.

Note: The DNS IPv6 to IPv4 option is disabled, by default, in the DNS profile.

Note: RPZ Rewriting is an optional BIND 9.x configuration that allows
administrators to create DNS blacklists.

Impact

Remote attackers may be able to cause a BIND denial-of-service (DoS) attack by
making a query for an AAAA record.

Security Advisory Status

F5 Product Development has assigned ID 643187 (BIG-IP) to this vulnerability.

To determine if your release is known to be vulnerable, the components or
features that are affected by the vulnerability, and for information about
releases or hotfixes that address the vulnerability, refer to the following
table:

+---------------+---------------+-----------------+-----------+---------------+
|               |Versions known |Versions known to|           |Vulnerable     |
|Product        |to be          |be not vulnerable|Severity   |component or   |
|               |vulnerable     |                 |           |feature        |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP LTM     |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |11.2.1           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP AAM     |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP AFM     |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP         |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|Analytics      |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |11.2.1           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP APM     |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |11.2.1           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP ASM     |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |11.2.1           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP DNS     |13.0.0         |13.0.0 HF1       |High       |BIND           |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP Edge    |None           |11.2.1           |Not        |None           |
|Gateway        |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |11.6.0 - 11.6.1|11.6.2           |           |               |
|BIG-IP GTM     |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |High       |BIND           |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |11.2.1           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP Link    |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|Controller     |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |11.2.1           |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|               |12.0.0 - 12.1.2|12.1.2 HF1       |           |               |
|BIG-IP PEM     |11.6.0 - 11.6.1|11.6.2           |High       |BIND           |
|               |11.5.0 - 11.5.4|11.4.1 - 11.4.1  |           |               |
|               |11.4.1 HF8 and |HF7              |           |               |
|               |later          |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP PSM     |11.4.1 HF8 and |11.4.1 - 11.4.1  |High       |BIND           |
|               |later          |HF7              |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IP         |None           |11.2.1           |Not        |None           |
|WebAccelerator |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |13.0.0         |13.0.0 HF1       |           |               |
|BIG-IP WebSafe |12.0.0 - 12.1.2|12.1.2 HF1       |High       |BIND           |
|               |11.6.0 - 11.6.1|11.6.2           |           |               |
|               |               |                 |           |               |
+---------------+---------------+-----------------+-----------+---------------+
|ARX            |None           |6.2.0 - 6.4.0    |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|Enterprise     |               |                 |Not        |               |
|Manager        |None           |3.1.1            |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Cloud   |None           |4.0.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Device  |None           |4.2.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ Security|None           |4.0.0 - 4.5.0    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|BIG-IQ ADC     |None           |4.5.0            |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IQ         |               |5.0.0 - 5.1.0    |Not        |               |
|Centralized    |None           |4.6.0            |vulnerable^|None           |
|Management     |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|BIG-IQ Cloud   |               |                 |Not        |               |
|and            |None           |1.0.0            |vulnerable^|None           |
|Orchestration  |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|               |               |                 |Not        |               |
|F5 iWorkflow   |None           |2.0.0 - 2.0.2    |vulnerable^|None           |
|               |               |                 |1          |               |
+---------------+---------------+-----------------+-----------+---------------+
|LineRate       |None           |2.5.0 - 2.6.1    |Not        |None           |
|               |               |                 |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+
|Traffix SDC    |None           |5.0.0 - 5.1.0    |Not        |None           |
|               |               |4.0.0 - 4.4.0    |vulnerable |               |
+---------------+---------------+-----------------+-----------+---------------+

^1 The specified products contain the affected code. However, F5 identifies the
vulnerability status as Not vulnerable because the attacker cannot exploit the
code in default, standard, or recommended configurations.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a
non-vulnerable version, then no upgrade candidate currently exists.

Mitigation

To mitigate this vulnerability, you can disable the DNS Ipv6 to IPv4 option in
the DNS profile, or disable RPZ in the BIND configuration. To disable the DNS
IPv6 to IPv4 option in the DNS profile, perform the following procedure:

Impact of action: The BIG-IP system does not map IPv4 addresses to IPv6
addresses for DNS resolutions.

 1. Log in to the Configuration utility.
 2. Navigate to DNS > Delivery > Profiles > DNS.
 3. Select the affected DNS profile.
 4. For the DNS IPv6 to IPv4 option, select Disabled.
 5. Click Update.

Alternatively, if you have manually enabled RPZ in the BIND configuration, you
can disable RPZ.

Supplemental Information

  o For more information about RPZ, refer to the following Internet Systems
    Consortium articles:
      Response Policy Zones
      Building DNS Firewalls with Response Policy Zones (RPZ)

    Note: The previous links take you to a resource outside of AskF5, and it
    is possible that the information may be removed without our knowledge.

  o K21520582: Overview of the DNS profile
  o K9970: Subscribing to email notifications regarding F5 products
  o K9957: Creating a custom RSS feed to view new and updated documents
  o K4602: Overview of the F5 security vulnerability response policy
  o K4918: Overview of the F5 critical issue hotfix policy
  o K167: Downloading software and firmware from F5
  o K13123: Managing BIG-IP product hotfixes (11.x - 13.x)
  o K9502: BIG-IP hotfix matrix

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWfwXdYx+lLeg9Ub1AQhgVRAAqufnUnMtYXc7P4I5dLcn+ohmHPXdRYGE
48geWvLpPLtoMZYjtkrBxdTob0Ibc0Cn+w7Sy8/kIjqXmLwPqPXeD7FDIkKMkFZK
FV2Dj10XS7ZWkTN5FeCPaQfM6Cds6V95w8xvInanpS1Cl1hRrlY71f3fTUUG1DzH
LqLnQ1Ri0tqdBDG47hYH4FTI1lANYxAzzOFeUi8AXODHSK9ix+qfyZ0k9nQKKDUl
DbCeQIbUgc5vasCmBYZdRiM94NIUcZhma7NcwwuJPoyJfzJzXXtBjZBJI9CgGYae
hU259FJ23Lv0M+LbNycBZEtRdpuKr8UxtERvbpYZ6c3U3LRPVCFpc9bWRMwgd+75
A/vZcce03Kjb/MOyw6lb6e+Z3aEyfar5Hn7c1qA7/FLwZamUxUkotelgCyX0Pz9b
Ixrc7LOul01gtwha5OSXcl5P4Bsf8pSDiOtvMxPuQpd9UIbXPdHSXRZ+mBm9b3n9
UaRp6rkvyuf2r49yoSfHEGWrMudAUorMHM0reHF+XtySWm437YCO/RY3vioYN5I6
YI8M7oidb4ycPplT1qM7niz40strBUixCDmjiKzH6GQDFwA+eo9gms12DfO5Bzct
4qdlkGi1o0KVCQIiUV8dY96hR/HbpgQ2MwY2Nzm1mo4L+1Gdw4qiGiJUveD7F0t9
8rP2wJgg2Bc=
=iVQW
-----END PGP SIGNATURE-----

« Back to bulletins