CVE-2017-6147 in BIG-IP
Summary
by MITRE
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed series of requests may cause TMM to restart, causing an interruption of service. Specifically, only BIG-IP Virtual Server with "SSL Forward Proxy" setting enabled in both the assigned Client and Server SSL profiles deployments are impacted by this issue. Customers with use cases which the "SSL Forward Proxy" setup connects to untrusted servers are at highest risk while customers with use cases which the "SSL Forward Proxy" setup connects to trusted servers have a lower risk.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/29/2022
The vulnerability identified as CVE-2017-6147 represents a critical service disruption flaw affecting multiple modules within F5 BIG-IP systems including Local Traffic Management AAM AFM Analytics APM ASM DNS Link Controller PEM and WebSafe components. This issue manifests through a specific sequence of requests that can cause the Traffic Management Microkernel TMM process to restart unexpectedly, resulting in immediate service interruption for affected virtual servers. The vulnerability specifically targets deployments where SSL Forward Proxy functionality is enabled in both client and server SSL profiles, creating a precise attack vector that requires particular configuration conditions to be exploited.
The technical mechanism behind this vulnerability involves the processing of certain request patterns through the TMM component when handling SSL Forward Proxy connections. When properly configured SSL Forward Proxy settings are present in both client and server profiles, the system's handling of specific request sequences triggers an internal error condition that leads to the TMM process termination and subsequent restart. This behavior represents a classic denial of service scenario where legitimate traffic processing causes the system to crash and recover, creating service interruptions that can last from seconds to minutes depending on the recovery process duration.
The operational impact of this vulnerability extends beyond simple service disruption to encompass potential business continuity risks for organizations relying on F5 BIG-IP systems for critical network infrastructure. The risk assessment varies significantly based on deployment architecture, with environments connecting to untrusted servers facing the highest exposure while those using trusted server connections present lower risk profiles. This differential risk assessment aligns with common security principles where external exposure increases attack surface and potential impact. The vulnerability's specificity to SSL Forward Proxy configurations means that organizations must carefully evaluate their deployment patterns to determine actual risk exposure.
Organizations should implement immediate mitigation strategies including disabling SSL Forward Proxy functionality where possible, implementing network segmentation to limit exposure to untrusted servers, and deploying monitoring solutions to detect anomalous request patterns that might trigger the vulnerability. The configuration changes required should align with security best practices for SSL termination and proxy handling, potentially involving the use of certificate pinning or additional validation mechanisms. From an ATT&CK framework perspective this vulnerability maps to T1499.004 Disruption of Service and T1566.002 Phishing with Malicious Attachments, as the attack pattern involves service disruption through specific request processing. The vulnerability also relates to CWE-691 Insufficient Control Flow Management and CWE-119 Improper Restriction of Operations within a Limited Access Point, indicating the need for proper input validation and control flow management within the SSL processing pipeline. Organizations should also consider implementing additional logging and alerting mechanisms to detect potential exploitation attempts and maintain detailed audit trails of SSL proxy configurations.