ESB-2017.3252 - [Appliance][Virtual] F5 Networks: Multiple vulnerabilities 2017-12-21

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.3252
          Security updates for F5 Traffic Management Microkernel
                             21 December 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           F5 BIG-IP products
                   F5 Enterprise Manager
                   F5 BIG-IQ products
Publisher:         F5 Networks
Operating System:  Network Appliance
                   Virtualisation
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-6164 CVE-2017-6151 CVE-2017-6138
                   CVE-2017-6136 CVE-2017-6134 CVE-2017-6133
                   CVE-2017-6132  

Original Bulletin: 
   https://support.f5.com/csp/article/K02714910
   https://support.f5.com/csp/article/K12044607
   https://support.f5.com/csp/article/K25033460
   https://support.f5.com/csp/article/K37404773
   https://support.f5.com/csp/article/K81137982
   https://support.f5.com/csp/article/K34514540
   https://support.f5.com/csp/article/K07369970

Comment: This bulletin contains seven (7) F5 Networks security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

K02714910: TLS vulnerability CVE-2017-6164

Security Advisory

Original Publication Date: Dec 21, 2017

Security Advisory Description

In some circumstances, the Traffic Management Microkernel (TMM) does not
properly handle certain malformed TLS1.2 records, which allows remote attackers
to cause a denial-of-service (DoS) or possible remote command execution on the
BIG-IP system. (CVE-2017-6164)

Impact

A remote attacker may be able cause a denial-of-service (DoS) or possibly run a
command remotely on the BIG-IP system.

Security Advisory Status

F5 Product Development has assigned ID 684879 (BIG-IP) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                  |      |Versions  |Fixes     |           |CVSSv3|Vulnerable|
|Product           |Branch|known to  |introduced|Severity   |Score^|component |
|                  |      |be        |in        |           |1     |or feature|
|                  |      |vulnerable|          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IP            |13.x  |13.0.0    |13.1.0    |           |      |          |
|(LTM, AAM, AFM,   |------+----------+----------|           |      |          |
|Analytics, APM,   |12.x  |12.0.0 -  |12.1.3    |           |      |          |
|ASM, DNS, Edge    |      |12.1.2    |          |           |      |ClientSSL |
|Gateway, GTM, Link|------+----------+----------|High       |8.1   |profile   |
|Controller, PEM,  |      |11.6.0 -  |          |           |      |          |
|WebAccelerator,   |11.x  |11.6.1    |11.6.2    |           |      |          |
|WebSafe)          |      |11.5.1 -  |11.5.5    |           |      |          |
|                  |      |11.5.4    |          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|ARX               |6.x   |None      |Not       |Not        |None  |None      |
|                  |      |          |available |vulnerable |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|                  |      |          |Not       |Not        |      |          |
|Enterprise Manager|3.x   |None      |available |vulnerable^|None  |None      |
|                  |      |          |          |2          |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IQ            |      |          |Not       |Not        |      |          |
|(Cloud, Device,   |4.x   |None      |available |vulnerable |None  |None      |
|Security, ADC)    |      |          |          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|                  |5.x   |None      |Not       |           |      |          |
|BIG-IQ Centralized|      |          |available |Not        |      |          |
|Management        |------+----------+----------|vulnerable |None  |None      |
|                  |4.x   |None      |Not       |           |      |          |
|                  |      |          |available |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IQ Cloud and  |1.x   |None      |Not       |Not        |None  |None      |
|Orchestration     |      |          |available |vulnerable |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|F5 iWorkflow      |2.x   |None      |Not       |Not        |None  |None      |
|                  |      |          |available |vulnerable |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|LineRate          |2.x   |None      |Not       |Not        |None  |None      |
|                  |      |          |available |vulnerable |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|                  |5.x   |None      |Not       |           |      |          |
|                  |      |          |available |Not        |      |          |
|Traffix SDC       |------+----------+----------|vulnerable |None  |None      |
|                  |4.x   |None      |Not       |           |      |          |
|                  |      |          |available |           |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

^2 The specified products contain the affected code. However, F5 identifies the
vulnerability status as Not vulnerable because the attacker cannot exploit the
code in default, standard, or recommended configurations.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.

To determine the necessary upgrade path for your BIG-IQ system, you should
understand the BIG-IQ product offering name changes. For more information,
refer to K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems
.

Mitigation

None

- --------------------------------------------------------------------------------

K12044607: TMM vulnerability CVE-2017-6132

Security Advisory
  
Original Publication Date: Dec 21, 2017

Security Advisory Description

Undisclosed sequence of packets sent to BIG-IP High Availability state mirror
listeners (primary and/or secondary IP) may cause TMM to restart. (
CVE-2017-6132)

Impact

The BIG-IP system may temporarily fail to process traffic as it recovers from a
TMM restart, and devices configured as a high-availability (HA) pair may fail
over.

Security Advisory Status

F5 Product Development has assigned ID 653993 (BIG-IP) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                   |      |Versions  |Fixes     |          |CVSSv3|Vulnerable|
|Product            |Branch|known to  |introduced|Severity  |score^|component |
|                   |      |be        |in        |          |1     |or feature|
|                   |      |vulnerable|          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |13.x  |13.0.0    |13.1.0    |          |      |          |
|BIG-IP (LTM, AAM,  |------+----------+----------|          |      |          |
|AFM, Analytics,    |12.x  |12.0.0 -  |12.1.3    |          |      |          |
|APM, ASM, DNS,     |      |12.1.2    |          |          |      |          |
|GTM, Link          |------+----------+----------|High      |7.5   |TMM       |
|Controller, PEM,   |      |11.6.0 -  |          |          |      |          |
|WebSafe)           |11.x  |11.6.1    |11.6.2    |          |      |          |
|                   |      |11.5.0 -  |11.5.5    |          |      |          |
|                   |      |11.5.4    |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|ARX                |6.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|Enterprise Manager |3.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ (Cloud,     |      |          |Not       |Not       |      |          |
|Device, Security,  |4.x   |None      |applicable|vulnerable|None  |None      |
|ADC)               |      |          |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|BIG-IQ Centralized |      |          |applicable|Not       |      |          |
|Management         |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ Cloud and   |1.x   |None      |Not       |Not       |None  |None      |
|Orchestration      |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|F5 iWorkflow       |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|LineRate           |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|Not       |      |          |
|Traffix SDC        |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable 
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.

Mitigation

To mitigate this vulnerability, you can configure a dedicated secure Virtual
Local Area Network (VLAN) for HA peer communications. For information, refer to
K14135: Defining network resources for BIG-IP HA features (11.x - 13.x).

Impact of action: Performing the suggested mitigation should not have a
negative impact on your system.

- --------------------------------------------------------------------------------

K25033460: TMM vulnerability CVE-2017-6133

Security Advisory

Original Publication Date: Dec 21, 2017

Applies to (see versions):

  * Product: BIG-IQ, BIG-IQ Cloud, BIG-IQ Device, BIG-IQ Security, BIG-IQ ADC,
    BIG-IQ Centralized Management
      + 5.3.0, 5.2.0, 5.1.0, 5.0.0, 4.6.0, 4.5.0, 4.4.0
  * Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM,
    BIG-IP ASM, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP GTM, BIG-IP Link
    Controller, BIG-IP LTM, BIG-IP PEM, BIG-IP PSM, BIG-IP WebAccelerator
      + 13.1.0, 13.0.0, 12.1.3, 12.1.2, 12.1.1, 12.1.0, 12.0.0, 11.6.2, 11.6.1,
        11.6.0, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1, 11.5.0, 11.4.1, 11.4.0,
        11.2.1
  * Product: Enterprise Manager
      + 3.1.1
  * Product: F5 iWorkflow
      + 2.3.0, 2.2.0, 2.1.0, 2.0.2, 2.0.1, 2.0.0
  * Product: LineRate
      + 2.6.2, 2.6.1, 2.6.0, 2.5.3, 2.5.2, 2.5.1, 2.5.0
  * Product: ARX, ARX
      + 6.4.0, 6.3.0, 6.2.0
  * Product: F5 WebSafe
      + 1.0.0
  * Product: Traffix SDC
      + 5.1.0, 4.4.0, 4.0.5, 4.0.2, 4.0.0
  * Product: BIG-IQ Cloud and Orchestration
      + 1.0.0

Security Advisory Description

Undisclosed HTTP requests may cause a denial of service (DoS). (CVE-2017-6133)

Impact

The Traffic Management Microkernel (TMM) generates a core file and restarts.
The BIG-IP system fails over to the peer device if configured as part of a high
availability (HA) device group.

Security Advisory Status

F5 Product Development has assigned ID 651221 (BIG-IP) and ID 655790 (F5
iWorkflow) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                   |      |Versions  |Fixes     |          |CVSSv3|Vulnerable|
|Product            |Branch|known to  |introduced|Severity  |score^|component |
|                   |      |be        |in        |          |1     |or feature|
|                   |      |vulnerable|          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |13.x  |13.0.0    |13.1.0    |          |      |          |
|BIG-IP (LTM, AAM,  |------+----------+----------|          |      |          |
|AFM, Analytics,    |12.x  |12.1.0 -  |12.1.3    |          |      |TMM URI   |
|APM, ASM, DNS, Link|      |12.1.2    |          |High      |7.1   |parser    |
|Controller, PEM,   |------+----------+----------|          |      |library   |
|WebSafe)           |11.x  |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IP (Edge       |      |          |Not       |Not       |      |          |
|Gateway, GTM, PSM, |11.x  |None      |applicable|vulnerable|None  |None      |
|WebAccelerator)    |      |          |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|ARX                |6.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|Enterprise Manager |3.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ (Cloud,     |      |          |Not       |Not       |      |          |
|Device, Security,  |4.x   |None      |applicable|vulnerable|None  |None      |
|ADC)               |      |          |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|BIG-IQ Centralized |      |          |applicable|Not       |      |          |
|Management         |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ Cloud and   |1.x   |None      |Not       |Not       |None  |None      |
|Orchestration      |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|F5 iWorkflow       |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|LineRate           |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|Not       |      |          |
|Traffix SDC        |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.

Mitigation

None

- --------------------------------------------------------------------------------

K37404773: TMM vulnerability CVE-2017-6134

Security Advisory

Original Publication Date: Dec 21, 2017

Security Advisory Description

An undisclosed sequence of packets, sourced from an adjacent network may cause
TMM to crash. (CVE-2017-6134)

Impact

This issue is exposed in the default configuration. Traffic processing is
disrupted while the Traffic Management Microkernel (TMM) restarts. If the
affected F5 device is configured as part of a device group, the system will
trigger a failover to the peer device.

Security Advisory Status

F5 Product Development has assigned ID 655059 (BIG-IP), ID 658348 (BIG-IQ), and
ID 658341 (Enterprise Manager) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                  |      |Versions  |Fixes     |           |CVSSv3|Vulnerable|
|Product           |Branch|known to  |introduced|Severity   |score^|component |
|                  |      |be        |in        |           |1     |or feature|
|                  |      |vulnerable|          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IP            |13.x  |13.0.0    |13.1.0    |           |      |          |
|(LTM, AAM, AFM,   |------+----------+----------|           |      |          |
|Analytics, APM,   |12.x  |12.1.0 -  |12.1.3    |           |      |          |
|ASM, DNS,         |      |12.1.2    |          |Medium     |6.5   |TMM       |
|GTM, Link         |------+----------+----------|           |      |          |
|Controller, PEM,  |11.x  |11.5.1 -  |11.6.2    |           |      |          |
|WebSafe)          |      |11.6.1    |11.5.5    |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IP            |      |          |Not       |Not        |      |          |
|(Edge Gateway,    |11.x  |None      |applicable|vulnerable |None  |None      |
|WebAccelerator)   |      |          |          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|ARX               |6.x   |None      |Not       |Not        |None  |None      |
|                  |      |          |applicable|vulnerable |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|Enterprise Manager|3.x   |3.1.1     |None      |Medium     |6.5   |TMM       |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IQ            |      |4.4.0 -   |          |           |      |          |
|(Cloud, Device,   |4.x   |4.5.0     |None      |Medium     |6.5   |TMM       |
|Security, ADC)    |      |          |          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|                  |5.x   |5.0.0 -   |None      |           |      |          |
|BIG-IQ Centralized|      |5.3.0     |          |Medium     |6.5   |TMM       |
|Management        |------+----------+----------|           |      |          |
|                  |4.x   |4.6.0     |None      |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|BIG-IQ Cloud and  |1.x   |1.0.0     |None      |Medium     |6.5   |TMM       |
|Orchestration     |      |          |          |           |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|                  |      |          |Not       |Not        |      |          |
|F5 iWorkflow      |2.x   |None      |applicable|vulnerable^|None  |None      |
|                  |      |          |          |2          |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|LineRate          |2.x   |None      |Not       |Not        |None  |None      |
|                  |      |          |applicable|vulnerable |      |          |
|------------------+------+----------+----------+-----------+------+----------|
|                  |5.x   |None      |Not       |           |      |          |
|                  |      |          |applicable|Not        |      |          |
|Traffix SDC       |------+----------+----------|vulnerable |None  |None      |
|                  |4.x   |None      |Not       |           |      |          |
|                  |      |          |applicable|           |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

^2 The specified products contain the affected code. However, F5 identifies the
vulnerability status as Not vulnerable because the attacker cannot exploit the
code in default, standard, or recommended configurations.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a
non-vulnerable version, then no upgrade candidate currently exists.

To determine the necessary upgrade path for your BIG-IQ system, you should
understand the BIG-IQ product offering name changes. For more information,
refer to K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems
.

Mitigation

None

- --------------------------------------------------------------------------------

K81137982: TMM vulnerability CVE-2017-6136

Security Advisory

Original Publication Date: Dec 21, 2017

Security Advisory Description

Undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast
Open and Tail Loss Probe options enabled in the associated TCP profile, may
cause a disruption of service to the Traffic Management Microkernel (TMM). (
CVE-2017-6136)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system to fail
over to another device in the device group.

Note: The Fast Open and the Tail Loss Probe TCP profile options are both
disabled in the default configuration, and both options must be enabled to
expose this vulnerability.

Security Advisory Status

F5 Product Development has assigned ID 659791 (BIG-IP) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                   |      |Versions  |Fixes     |          |CVSSv3|Vulnerable|
|Product            |Branch|known to  |introduced|Severity  |score^|component |
|                   |      |be        |in        |          |1     |or feature|
|                   |      |vulnerable|          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |13.x  |13.0.0    |13.1.0    |          |      |          |
|BIG-IP (LTM, AAM,  |------+----------+----------|          |      |          |
|AFM, Analytics,    |12.x  |12.0.0 -  |12.1.3    |          |      |          |
|APM, ASM, DNS, GTM,|      |12.1.2    |          |Medium    |5.9   |TMM       |
|Link Controller,   |------+----------+----------|          |      |          |
|PEM, WebSafe)      |11.x  |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|ARX                |6.x   |None      |Not       |Not       |      |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|Enterprise Manager |3.x   |None      |Not       |Not       |      |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ (Cloud,     |      |          |Not       |Not       |      |          |
|Device, Security,  |4.x   |None      |applicable|vulnerable|      |None      |
|ADC)               |      |          |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|BIG-IQ Centralized |      |          |applicable|Not       |      |          |
|Management         |------+----------+----------|vulnerable|      |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ Cloud and   |1.x   |None      |Not       |Not       |      |None      |
|Orchestration      |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|F5 iWorkflow       |2.x   |None      |Not       |Not       |      |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|LineRate           |2.x   |None      |Not       |Not       |      |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|Not       |      |          |
|Traffix SDC        |------+----------+----------|vulnerable|      |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.

Mitigation

None

- --------------------------------------------------------------------------------

K34514540: TMM vulnerability CVE-2017-6138

Security Advisory

Original Publication Date: Dec 21, 2017

Security Advisory Description

Malicious requests made to virtual servers with an HTTP profile can cause the
TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of
settings. The issue is also exposed with the non-default "normalize URI"
configuration options used in iRules and/or BIG-IP LTM policies. (CVE-2017-6138
)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system to fail
over to another device in the device group. This vulnerability affects systems
with any of the following configurations:

  * A virtual server associated with a BIG-IP APM profile.
  * A virtual server associated with an HTTP profile and a local traffic policy
    that has a rule condition with the HTTP URI and Use normalized URI options
    enabled (the Use normalized URI option is disabled by default).

    For example, in the following configuration excerpt, the local traffic
    policy is vulnerable:

    ltm policy /Common/K34514540 {

        requires { http }
        rules {
            vulnerable {
                conditions {
                    0 {
                        http-uri
                        path
                        normalized
                        values { /exploitable }
                    }
                }
            }
        }
        strategy /Common/first-match
    }
  * A virtual server associated with an HTTP profile and an iRule using any of
    the following iRules commands with the -normalized switch:
      + HTTP::uri
      + HTTP::query
      + HTTP::path

    For example:

    when HTTP_REQUEST {
         if { ([HTTP::uri -normalized] starts_with "/exploitable")} {
              log local0.error "K34514540 URI example"
         } elseif { ([HTTP::query -normalized] starts_with "/exploitable")} {
              log local0.error "K34514540 Query example"
         } elseif { ([HTTP::path -normalized] starts_with "/exploitable")} {
              log local0.error "K34514540 Path example"
         }
    }

Security Advisory Status

F5 Product Development has assigned ID 662022 (BIG-IP) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                   |      |Versions  |Fixes     |          |CVSSv3|Vulnerable|
|Product            |Branch|known to  |Introduced|Severity  |score^|component |
|                   |      |be        |In        |          |1     |or feature|
|                   |      |vulnerable|          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IP (LTM, AAM,  |13.x  |13.0.0    |13.1.0    |          |      |          |
|AFM, Analytics,    |------+----------+----------|          |      |          |
|APM, ASM, DNS,     |12.x  |12.1.0 -  |12.1.3    |          |      |          |
|GTM, Link          |      |12.1.2    |          |High      |7.5   |TMM       |
|Controller, PEM,   |------+----------+----------|          |      |          |
|WebSafe)           |11.x  |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|ARX                |6.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|Enterprise Manager |3.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ (Cloud,     |      |          |Not       |Not       |      |          |
|Device, Security,  |4.x   |None      |applicable|vulnerable|None  |None      |
|ADC)               |      |          |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|BIG-IQ Centralized |      |          |applicable|Not       |      |          |
|Management         |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ Cloud and   |1.x   |None      |Not       |Not       |None  |None      |
|Orchestration      |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|F5 iWorkflow       |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|LineRate           |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|Not       |      |          |
|Traffix SDC        |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.

Mitigation

To mitigate this vulnerability, you should avoid using:

  * the normalize option with L7 policies.
  * the -normalize option with HTTP::uri, HTTP::query, or HTTP::path iRules
    commands.

Impact of action: The impact of the suggested mitigation depends on the
specific environment. F5 recommends testing any such changes during a
maintenance window with consideration to the possible impact on your specific
environment.

- --------------------------------------------------------------------------------

K07369970: TMM vulnerability CVE-2017-6151

Security Advisory

Original Publication Date: Dec 21, 2017

Security Advisory Description

Undisclosed requests made to BIG-IP virtual servers that use the "HTTP/2
profile" may result in a disruption of service to TMM. (CVE-2017-6151)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system to fail
over to another device in the device group. This vulnerability affects the
BIG-IP system when virtual servers are configured with an HTTP/2 profile.

Security Advisory Status

F5 Product Development has assigned ID 668501 (BIG-IP) to this vulnerability.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases or hotfixes that
address the vulnerability, refer to the following table.

+-----------------------------------------------------------------------------+
|                   |      |Versions  |Fixes     |          |CVSSv3|Vulnerable|
|Product            |Branch|known to  |introduced|Severity  |score^|component |
|                   |      |be        |in        |          |1     |or feature|
|                   |      |vulnerable|          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IP (LTM, AAM,  |13.x  |13.0.0    |13.1.0    |          |      |          |
|AFM, Analytics,    |------+----------+----------|          |      |TMM       |
|APM, ASM, DNS, Edge|12.x  |None      |Not       |          |      |(virtual  |
|Gateway, GTM, Link |      |          |applicable|High      |7.5   |servers   |
|Controller, PEM,   |------+----------+----------|          |      |with HTTP/|
|WebAccelerator,    |11.x  |None      |Not       |          |      |2 profile)|
|WebSafe)           |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|ARX                |6.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|Enterprise Manager |3.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ (Cloud,     |      |          |Not       |Not       |      |          |
|Device, Security,  |4.x   |None      |applicable|vulnerable|None  |None      |
|ADC)               |      |          |          |          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|BIG-IQ Centralized |      |          |applicable|Not       |      |          |
|Management         |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
|-------------------+------+----------+----------+----------+------+----------|
|BIG-IQ Cloud and   |1.x   |None      |Not       |Not       |None  |None      |
|Orchestration      |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|F5 iWorkflow       |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|LineRate           |2.x   |None      |Not       |Not       |None  |None      |
|                   |      |          |applicable|vulnerable|      |          |
|-------------------+------+----------+----------+----------+------+----------|
|                   |5.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|Not       |      |          |
|Traffix SDC        |------+----------+----------|vulnerable|None  |None      |
|                   |4.x   |None      |Not       |          |      |          |
|                   |      |          |applicable|          |      |          |
+-----------------------------------------------------------------------------+

^1The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

Security Advisory Recommended Actions

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Fixes introduced in column. If the table lists only an older version
than what you are currently running, or does not list a non-vulnerable version,
then no upgrade candidate currently exists.

Note: For details about how Security Advisory articles are versioned, and what
versions are listed in the table, refer to K51812227: Understanding Security
Advisory versioning.

Mitigation

None

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWjsYHIx+lLeg9Ub1AQgFHQ/9FEoq0SyeXFi1l2zjyCBVmqhbX+KOEK2q
r3cfYNpNbJyu9/+r2u6IGFZArB9D6VKlfJsvBWrOKnbqKwHsgadSyZf0KHDrjWNy
nAOYsRbf80SDztTxnB2ocTITymSHP6l2cdOcWUkgZV0tB6iui63Jb1lfV2ea0SlT
gzbzKO/MbvAdYiXia6IByYQD2ZZKqW3ZDCUR/nHwQpl2NdO/7GyMmmnTOt+MpGkW
hIvI61i3ztkZiFYHXkKozDOcOonaVeLaOIDdFFLTsMn0r0Bbyf8V6ASqCHRCyTev
p6k66pFukNP53B+Q9D48niQr5tTY8C39lb2gnx4x0ZcQWZzTkOhjiPYA8OvtRjws
0DlEhgY8PW5/akq272MTtnZfC+cX+M4ifWUapM4bZp2PSpxMIqO36Ip1p/w++j36
wFm7+eR15dbb0t2kuwpcfbSzWqFtI5Lk07FE9XValt4/FBGwVfuh73cAt2QzNQgp
EZvWF7eVMAWNn1XvQWFULtNWBxBM69zvfyj1vqQ0Mxf5zY6mzzGEBdLaty7FHE3n
emJuqn+vacWB29bPNaGzxVtd5ftmZ88PJum+zn5DEgH0Kg3wduBm6vwX7cX5xax9
UIYBJlhAlXQfinab497XiiXebGc7h3SNai+jkncs0hCBbAWfUIZLXDZp286pSkMx
ARD8IPQmI9A=
=TYYi
-----END PGP SIGNATURE-----

« Back to bulletins