-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.1300
              SOL15439022: glibc vulnerability CVE-2016-3075
                                24 May 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           F5 BIG-IP products
                   F5 ARX
                   F5 BIG-IQ products
Publisher:         F5 Networks
Operating System:  Network Appliance
                   Virtualisation
                   Linux variants
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Mitigation
CVE Names:         CVE-2016-3075  

Original Bulletin: 
   https://support.f5.com/kb/en-us/solutions/public/k/15/sol15439022.html

- --------------------------BEGIN INCLUDED TEXT--------------------

SOL15439022: glibc vulnerability CVE-2016-3075

Security Advisory

Original Publication Date: 05/23/2016

Updated Date: 05/23/2016

Vulnerability Description

A stack overflow vulnerability (unbounded allocation) in 
_nss_dns_getnetbyname_r function was found. (CVE-2016-3075)

Impact

BIG-IP, BIG-IQ, and Enterprise Manager

While the functionality in question is included with BIG-IP, BIG-IQ, and 
Enterprise Manager, these products are not vulnerable in a default or standard
configuration because the function is never utilized. This vulnerability can 
only be exploited if you enable DNS for networks in the Name Service Switch 
configuration file (/etc/nsswitch.conf) or utilize the function in question by
means of an Extended Content Verification (ECV) monitor or custom binary.

ARX

This vulnerability can be exposed if DNS for networks is enabled in the Name 
Service Switch configuration.

Security Issue Status

F5 Product Development has assigned ID 587756 (BIG-IP), ID 588204 (BIG-IQ), ID
588208 (Enterprise Manager), and ID 476571 (ARX) to this vulnerability, and 
has evaluated the currently supported releases for potential vulnerability.

To determine if your release is known to be vulnerable, the components or 
features that are affected by the vulnerability, and for information about 
releases or hotfixes that address the vulnerability, refer to the following 
table:

Product 		Versions known to be vulnerable 	Versions known to be not vulnerable 	Severity 	Vulnerable component or feature

BIG-IP LTM 		12.0.0 - 12.1.0				None 					Low 		glibc	
			11.0.0 - 11.6.1
			10.1.0 - 10.2.4 

BIG-IP AAM 		12.0.0 - 12.1.0				None 					Low 		glibc
			11.4.0 - 11.6.1 

BIG-IP AFM 		12.0.0 - 12.1.0				None 					Low 		glibc
			11.3.0 - 11.6.1

BIG-IP Analytics 	12.0.0 - 12.1.0				None 					Low 		glibc
			11.0.0 - 11.6.1 

BIG-IP APM 		12.0.0 - 12.1.0				None 					Low 		glibc
			11.0.0 - 11.6.1
			10.1.0 - 10.2.4 

BIG-IP ASM 		12.0.0 - 12.1.0				None 					Low 		glibc
			11.0.0 - 11.6.1
			10.1.0 - 10.2.4 

BIG-IP DNS 		12.0.0 - 12.1.0 			None 					Low 		glibc

BIG-IP Edge Gateway 	11.0.0 - 11.3.0				None 					Low 		glibc
			10.1.0 - 10.2.4 

BIG-IP GTM 		11.0.0 - 11.6.1				None 					Low 		glibc
			10.1.0 - 10.2.4 

BIG-IP Link Controller 	12.0.0 - 12.1.0				None 					Low 		glibc
			11.0.0 - 11.6.1
			10.1.0 - 10.2.4 

BIG-IP PEM 		12.0.0 - 12.1.0				None 					Low 		glibc
			11.3.0 - 11.6.1

BIG-IP PSM 		11.0.0 - 11.4.1				None 					Low 		glibc
			10.1.0 - 10.2.4

BIG-IP WebAccelerator 	11.0.0 - 11.3.0				None 					Low 		glibc
			10.1.0 - 10.2.4

BIG-IP WOM 		11.0.0 - 11.3.0				None 					Low 		glibc
			10.1.0 - 10.2.4 

ARX 			6.0.0 - 6.4.0 				None 					Low 		glibc

Enterprise Manager 	3.0.0 - 3.1.1 				None 					Low 		glibc

FirePass 		None 					7.0.0					Not vulnerable 	None
								6.0.0 - 6.1.0

BIG-IQ Cloud 		4.0.0 - 4.5.0 				None 					Low 		glibc

BIG-IQ Device 		4.2.0 - 4.5.0 				None 					Low 		glibc

BIG-IQ Security 	4.0.0 - 4.5.0 				None 					Low 		glibc

BIG-IQ ADC 		4.5.0 					None 					Low 		glibc

BIG-IQ Centralized 	4.6.0 					None 					Low 		glibc
 Management 		

BIG-IQ Cloud and 	1.0.0 					None 					Low 		glibc
 Orchestration 		

LineRate 		None 					2.5.0 - 2.6.1 				Not vulnerable 	None

F5 MobileSafe 		None 					1.0.0 					Not vulnerable 	None

F5 WebSafe 		None 					1.0.0 					Not vulnerable 	None

Traffix SDC 		None 					5.0.0					Not vulnerable 	None
								4.0.0 - 4.4.0
								3.3.2 - 3.5.1 

Vulnerability Recommended Actions

If you are running a version listed in the Versions known to be vulnerable 
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a 
non-vulnerable version, then no upgrade candidate currently exists.

F5 responds to vulnerabilities in accordance with the Severity values 
published in the previous table. The Severity values and other security 
vulnerability parameters are defined in SOL4602: Overview of the F5 security 
vulnerability response policy.

BIG-IP, BIG-IQ, and Enterprise Manager

To mitigate this vulnerability for BIG-IP, BIG-IQ, and Enterprise Manager, you
can remove reference to the vulnerable function in any configured ECV monitors
and disable DNS for networks in the /etc/nsswitch.conf file. In addition, you
should permit access to F5 products only over a secure network, and limit 
login access to trusted users. For more information, refer to SOL13092: 
Overview of securing access to the BIG-IP system.

ARX

To mitigate this vulnerability for ARX, you can disable DNS for networks in 
the Name Service Switch configuration.

Supplemental Information

SOL9970: Subscribing to email notifications regarding F5 products

SOL9957: Creating a custom RSS feed to view new and updated documents

SOL4918: Overview of the F5 critical issue hotfix policy

SOL167: Downloading software and firmware from F5

SOL13123: Managing BIG-IP product hotfixes (11.x - 12.x)

SOL10025: Managing BIG-IP product hotfixes (10.x)

SOL9502: BIG-IP hotfix matrix

SOL15106: Managing BIG-IQ product hotfixes

SOL15113: BIG-IQ hotfix matrix

SOL12766: ARX hotfix matrix

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBV0PYYX6ZAP0PgtI9AQKgoxAAsoMztM8HkrPCbLYfiZVV4+hiSjnfgU/e
bFYTVbiwkUc1h6HmKJe7/o2L/FYWjGf2YJDSKb0/029mZvtRhJsx8oFFZMaDv5uz
UXAGp4SmZRErpIzJ9delnc+X+fAm7b7MXzUH5TQGOl6QP7CAtLkLBDp8zZ2YslYz
bVH4jvJyiCl2Nk83j8tKBkowcedhaFpACnLMS4L+w+5LWQRfqjs6pRgFHAFDYvM0
nQ/DzzTJr6eyJF+RXVbiZAG74o1Tvvzd7RJmuGYQXZ5PE/BIje7S0P+AxcxvHnwm
oyBEoXyJiOdCXukjUBPtU39+Db9GGbFiME+X+tkdwjtv9Lf0Wz3q7BV79OPt5f4B
0AnMivV3YMvkb+pxb4tsMgS6gSNiQgH56OBOpZ8n7mh9wNkJ8yFR3/JsHFZWtst3
57bAXaLNU6HRAVPcIR9o+ADHXgqO9Z9CM8nvHIEJ27NZxFzb0qWYUIPH8QjBGqUv
eAcPh2pYAHkpyHm44eamPPPjK8/TBv/I1Wyp1gCIhm/R74qtorTnm87lrbRkPHfr
gHqGaQWL9Wt0bI8dvqkHmmZILAg/4yGJQraC94zT28cnvU4372EiI+cI/EtPEqjD
/kAxqQo6/nbO1Kk3b4Yo0eMfoL7X33PHsjUFgH7VkABiNXnfMRJv6mhjX0wVG+N6
5TepEv/l928=
=UzHe
-----END PGP SIGNATURE-----