Summaryinfo

A vulnerability, which was classified as problematic, was found in F5 BIG-IP 12.1.0/12.1.1/12.1.2. This affects an unknown part of the component TLS Handshake Handler. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2017-6141. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in F5 BIG-IP 12.1.0/12.1.1/12.1.2 (Firewall Software). Affected by this issue is an unknown code of the component TLS Handshake Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. CVE summarizes:

In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default.

The bug was discovered 07/19/2017. The weakness was presented 10/20/2017 (Website). The advisory is shared for download at support.f5.com. This vulnerability is handled as CVE-2017-6141 since 02/21/2017. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 101491 (F5 Networks BIG-IP : TMM SSL/TLS profile vulnerability (K21154730)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family F5 Networks Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370480 (F5 BIG-IP ASM TMM SSL/TLS Profile Vulnerability (K21154730)).

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (101491). See VDB-108311 and VDB-108310 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 12.1.0
• 12.1.1
• 12.1.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion