Sign-up

ID

VAR-201704-0345


CVE

CVE-2016-7467


TITLE

F5 BIG-IP APM Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-008349

DESCRIPTION

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector. F5 BIG-IP APM Contains an input validation vulnerability.Service operation interruption (DoS) An attack may be carried out. F5BIG-IP is a load balancer that uses a variety of allocation algorithms to distribute network requests to available servers in a server cluster. By managing incoming web data traffic and increasing effective network bandwidth, network visitors get as much as possible. The hardware device for the best networking experience. A denial of service vulnerability exists in F5BIG-IPAPM. A remote attacker could exploit this vulnerability to cause the service to restart, resulting in a denial of service condition. F5 BIG-IP APM is prone to a remote denial-of-service vulnerability. F5 BIG-IP APM is a set of access and security solutions from F5 Corporation of the United States. The solution provides unified access to business-critical applications and networks. TMM SSO is one of the single sign-on plug-ins used to execute the traffic management service process. An attacker could exploit this vulnerability to temporarily disrupt traffic with malformed and signed SAML authentication requests. The following products and versions are affected: F5 BIG-IP APM version 12.0.0 to version 12.1.1; version 11.6.0 to version 11.6.1 HF1; version 11.5.4 to version 11.5.4 HF2

Trust: 2.52

sources: NVD: CVE-2016-7467 // JVNDB: JVNDB-2016-008349 // CNVD: CNVD-2017-05634 // BID: 97168 // VULHUB: VHN-96287

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-05634

AFFECTED PRODUCTS

vendor:f5model:big-ip access policy managerscope:eqversion:11.6.1

Trust: 1.6

vendor:f5model:big-ip access policy managerscope:eqversion:12.1.0

Trust: 1.6

vendor:f5model:big-ip access policy managerscope:eqversion:11.5.4

Trust: 1.6

vendor:f5model:big-ip access policy managerscope:eqversion:11.6.0

Trust: 1.6

vendor:f5model:big-ip access policy managerscope:eqversion:12.0.0

Trust: 1.6

vendor:f5model:big-ip access policy managerscope:eqversion:12.1.1

Trust: 1.6

vendor:f5model:big-ip access policy managerscope:eqversion:11.5.4 - 11.5.4 hf2

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:11.6.0 - 11.6.1 hf1

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:12.0.0 - 12.1.1

Trust: 0.8

vendor:f5model:big-ip apmscope:gteversion:12.0.0,<=12.1.1

Trust: 0.6

vendor:f5model:big-ip apm <=11.6.1hf1scope:gteversion:11.6.0

Trust: 0.6

vendor:f5model:big-ip apm >=11.5.4,<=11.5.4hf2scope: - version: -

Trust: 0.6

vendor:f5model:big-ip apmscope:eqversion:12.1.1

Trust: 0.3

vendor:f5model:big-ip apm hf2scope:eqversion:12.1

Trust: 0.3

vendor:f5model:big-ip apm hf1scope:eqversion:12.1

Trust: 0.3

vendor:f5model:big-ip apm hf4scope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip apm hf3scope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip apm hf2scope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip apm buildscope:eqversion:12.01.14.628

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip apm hf1scope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip apm hf8scope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip apm hf7scope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip apm hf6scope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip apm hf5scope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip apm hf4scope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip apm hf3scope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip apm buildscope:eqversion:11.66.204.442

Trust: 0.3

vendor:f5model:big-ip apm hf2scope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip apm hf1scope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip apm buildscope:eqversion:11.5.40.1.256

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:12.1.0

Trust: 0.3

vendor:f5model:big-ip apm hf1scope:eqversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:12.1.2

Trust: 0.3

vendor:f5model:big-ip apm hf2scope:neversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip apm hf3scope:neversion:11.5.4

Trust: 0.3

sources: CNVD: CNVD-2017-05634 // BID: 97168 // JVNDB: JVNDB-2016-008349 // CNNVD: CNNVD-201703-1254 // NVD: CVE-2016-7467

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-7467
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-7467
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-05634
value: LOW

Trust: 0.6

CNNVD: CNNVD-201703-1254
value: LOW

Trust: 0.6

VULHUB: VHN-96287
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2016-7467
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-05634
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-96287
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-7467
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-05634 // VULHUB: VHN-96287 // JVNDB: JVNDB-2016-008349 // CNNVD: CNNVD-201703-1254 // NVD: CVE-2016-7467

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-96287 // JVNDB: JVNDB-2016-008349 // NVD: CVE-2016-7467

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-1254

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201703-1254

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-008349

PATCH
title:K95444512: TMM SSO plugin vulnerability CVE-2016-7467url:https://support.f5.com/csp/article/K95444512
Trust: 0.8
title:Patch for F5BIG-IPAPM Denial of Service Vulnerability (CNVD-2017-05634)url:https://www.cnvd.org.cn/patchInfo/show/92246
Trust: 0.6
title:F5 BIG-IP APM TMM SSO Plugin input verification vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74775
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-05634 // 
            
            
            
            JVNDB: JVNDB-2016-008349 // 
            
            
            
            CNNVD: CNNVD-201703-1254

EXTERNAL IDS
db:NVDid:CVE-2016-7467
Trust: 3.4
db:BIDid:97168
Trust: 2.6
db:SECTRACKid:1038131
Trust: 1.1
db:JVNDBid:JVNDB-2016-008349
Trust: 0.8
db:CNNVDid:CNNVD-201703-1254
Trust: 0.7
db:CNVDid:CNVD-2017-05634
Trust: 0.6
db:VULHUBid:VHN-96287
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-05634 // 
            
            
            
            VULHUB: VHN-96287 // 
            
            
            
            BID: 97168 // 
            
            
            
            JVNDB: JVNDB-2016-008349 // 
            
            
            
            CNNVD: CNNVD-201703-1254 // 
            
            
            
            NVD: CVE-2016-7467

REFERENCES
url:http://www.securityfocus.com/bid/97168
Trust: 2.3
url:https://support.f5.com/csp/article/k95444512
Trust: 2.0
url:https://nvd.nist.gov/vuln/detail/cve-2016-7467
Trust: 1.4
url:http://www.securitytracker.com/id/1038131
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7467
Trust: 0.8
url:http://www.f5.com/products/big-ip/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-05634 // 
            
            
            
            VULHUB: VHN-96287 // 
            
            
            
            BID: 97168 // 
            
            
            
            JVNDB: JVNDB-2016-008349 // 
            
            
            
            CNNVD: CNNVD-201703-1254 // 
            
            
            
            NVD: CVE-2016-7467

CREDITS
The vendor reported the issue.
Trust: 0.3
sources:
            
            
            BID: 97168

SOURCES
db:CNVDid:CNVD-2017-05634
db:VULHUBid:VHN-96287
db:BIDid:97168
db:JVNDBid:JVNDB-2016-008349
db:CNNVDid:CNNVD-201703-1254
db:NVDid:CVE-2016-7467

LAST UPDATE DATE
2024-11-23T22:45:24.285000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-05634date:2017-04-29T00:00:00
db:VULHUBid:VHN-96287date:2017-07-12T00:00:00
db:BIDid:97168date:2017-03-29T00:03:00
db:JVNDBid:JVNDB-2016-008349date:2017-05-16T00:00:00
db:CNNVDid:CNNVD-201703-1254date:2017-09-29T00:00:00
db:NVDid:CVE-2016-7467date:2024-11-21T02:58:03.833

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-05634date:2017-04-21T00:00:00
db:VULHUBid:VHN-96287date:2017-04-11T00:00:00
db:BIDid:97168date:2017-03-23T00:00:00
db:JVNDBid:JVNDB-2016-008349date:2017-05-16T00:00:00
db:CNNVDid:CNNVD-201703-1254date:2017-03-23T00:00:00
db:NVDid:CVE-2016-7467date:2017-04-11T14:59:00.223