var-201803-1076
Vulnerability from variot
On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when processing undisclosed types of data on systems with 48 or more CPU cores. BIG-IP ASM Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. F5BIG-IPASM (ApplicationSecurityManager) is a Web Application Firewall (WAF) from F5 Corporation of the United States that provides secure remote access, secure email protection, and simplified Web access control while enhancing network and application performance. There is a security hole in F5BIG-IPASM. An attacker could exploit this vulnerability to interrupt traffic processing and perform failover. F5 BIG-IP ASM is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the application resulting in denial-of-service conditions
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201803-1076", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "big-ip application security manager", "scope": "eq", "trust": 1.6, "vendor": "f5", "version": "13.0.0" }, { "model": "big-ip application security manager", "scope": "gte", "trust": 1.0, "vendor": "f5", "version": "12.1.0" }, { "model": "big-ip application security manager", "scope": "lte", "trust": 1.0, "vendor": "f5", "version": "12.1.3.1" }, { "model": "big-ip application security manager", "scope": "lte", "trust": 1.0, "vendor": "f5", "version": "11.6.2" }, { "model": "big-ip application security manager", "scope": "gte", "trust": 1.0, "vendor": "f5", "version": "11.6.1" }, { "model": "big-ip application security manager", "scope": null, "trust": 0.8, "vendor": "f5", "version": null }, { "model": "big-ip asm", "scope": "eq", "trust": 0.6, "vendor": "f5", "version": "13.0.0" }, { "model": "big-ip asm", "scope": "gte", "trust": 0.6, "vendor": "f5", "version": "12.1.0,\u003c=12.1.3.1" }, { "model": "big-ip asm", "scope": "gte", "trust": 0.6, "vendor": "f5", "version": "11.6.1\u003c=11.6.2" }, { "model": "big-ip application security manager", "scope": "eq", "trust": 0.6, "vendor": "f5", "version": "12.1.1" }, { "model": "big-ip asm hf3", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "13.0" }, { "model": "big-ip asm hf2", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "13.0" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "13.0" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "13.0" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.3" }, { "model": "big-ip asm hf2", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.2" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.2" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.2" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.1" }, { "model": "big-ip asm hf2", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1" }, { "model": "big-ip asm hf4", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.0" }, { "model": "big-ip asm build", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.01.14.628" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.0" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "11.6.2" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "11.6.2" }, { "model": "big-ip asm hf2", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "11.6.1" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "11.6.1" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "11.6.1" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.1" }, { "model": "big-ip asm", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.1.0" }, { "model": "big-ip asm hf3", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.0.0" }, { "model": "big-ip asm hf2", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.0.0" }, { "model": "big-ip asm hf1", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "12.0.0" }, { "model": "big-ip asm", "scope": "ne", "trust": 0.3, "vendor": "f5", "version": "13.1" }, { "model": "big-ip asm", "scope": "ne", "trust": 0.3, "vendor": "f5", "version": "11.6.3" }, { "model": "big-ip asm", "scope": "ne", "trust": 0.3, "vendor": "f5", "version": "12.1.3.2" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "BID", "id": "103233" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "NVD", "id": "CVE-2017-6154" }, { "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "11.6.2", "versionStartIncluding": "11.6.1", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:f5:big-ip_application_security_manager:13.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "12.1.3.1", "versionStartIncluding": "12.1.0", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2017-6154" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The vendor reported the issue.", "sources": [ { "db": "BID", "id": "103233" } ], "trust": 0.3 }, "cve": "CVE-2017-6154", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "impactScore": 2.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 5.0, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2017-6154", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "CNVD-2018-04644", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "VHN-114357", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2017-6154", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2017-6154", "trust": 1.8, "value": "HIGH" }, { "author": "CNVD", "id": "CNVD-2018-04644", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201803-038", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-114357", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "VULHUB", "id": "VHN-114357" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "NVD", "id": "CVE-2017-6154" }, { "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when processing undisclosed types of data on systems with 48 or more CPU cores. BIG-IP ASM Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. F5BIG-IPASM (ApplicationSecurityManager) is a Web Application Firewall (WAF) from F5 Corporation of the United States that provides secure remote access, secure email protection, and simplified Web access control while enhancing network and application performance. There is a security hole in F5BIG-IPASM. An attacker could exploit this vulnerability to interrupt traffic processing and perform failover. F5 BIG-IP ASM is prone to a remote denial-of-service vulnerability. \nAn attacker can exploit this issue to crash the application resulting in denial-of-service conditions", "sources": [ { "db": "NVD", "id": "CVE-2017-6154" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "BID", "id": "103233" }, { "db": "VULHUB", "id": "VHN-114357" } ], "trust": 2.52 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2017-6154", "trust": 3.4 }, { "db": "BID", "id": "103233", "trust": 1.4 }, { "db": "JVNDB", "id": "JVNDB-2017-012784", "trust": 0.8 }, { "db": "CNVD", "id": "CNVD-2018-04644", "trust": 0.6 }, { "db": "NSFOCUS", "id": "39048", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-201803-038", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-114357", "trust": 0.1 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "VULHUB", "id": "VHN-114357" }, { "db": "BID", "id": "103233" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "NVD", "id": "CVE-2017-6154" }, { "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "id": "VAR-201803-1076", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "VULHUB", "id": "VHN-114357" } ], "trust": 1.15944443 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" } ] }, "last_update_date": "2023-12-18T12:02:33.108000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "K38243073", "trust": 0.8, "url": "https://support.f5.com/csp/article/k38243073" }, { "title": "F5BIG-IPASM has an unexplained patch", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/120471" }, { "title": "F5 BIG-IP ASM Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=78833" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-20", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-114357" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "NVD", "id": "CVE-2017-6154" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.6, "url": "https://support.f5.com/csp/article/k38243073" }, { "trust": 1.1, "url": "http://www.securityfocus.com/bid/103233" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6154" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6154" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/39048" }, { "trust": 0.3, "url": "http://www.f5.com/products/big-ip/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "VULHUB", "id": "VHN-114357" }, { "db": "BID", "id": "103233" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "NVD", "id": "CVE-2017-6154" }, { "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2018-04644" }, { "db": "VULHUB", "id": "VHN-114357" }, { "db": "BID", "id": "103233" }, { "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "db": "NVD", "id": "CVE-2017-6154" }, { "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-03-08T00:00:00", "db": "CNVD", "id": "CNVD-2018-04644" }, { "date": "2018-03-01T00:00:00", "db": "VULHUB", "id": "VHN-114357" }, { "date": "2018-03-01T00:00:00", "db": "BID", "id": "103233" }, { "date": "2018-04-16T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "date": "2018-03-01T16:29:00.293000", "db": "NVD", "id": "CVE-2017-6154" }, { "date": "2018-03-05T00:00:00", "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-03-08T00:00:00", "db": "CNVD", "id": "CNVD-2018-04644" }, { "date": "2018-03-23T00:00:00", "db": "VULHUB", "id": "VHN-114357" }, { "date": "2018-03-01T00:00:00", "db": "BID", "id": "103233" }, { "date": "2018-04-16T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-012784" }, { "date": "2018-03-23T13:38:31.617000", "db": "NVD", "id": "CVE-2017-6154" }, { "date": "2018-03-05T00:00:00", "db": "CNNVD", "id": "CNNVD-201803-038" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201803-038" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "BIG-IP ASM Input validation vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-012784" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "input validation", "sources": [ { "db": "CNNVD", "id": "CNNVD-201803-038" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.