Details of VAR-201705-3517

ID

VAR-201705-3517

CVE

CVE-2016-9253

TITLE

plural F5 BIG-IP Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2016-008556

DESCRIPTION

In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile. plural F5 BIG-IP The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. F5BIG-IP is a load balancer that uses a variety of allocation algorithms to distribute network requests to available servers in a server cluster. By managing incoming web data traffic and increasing effective network bandwidth, network visitors get as much as possible. The hardware device for the best networking experience. F5BIG-IP remote presence denial of service vulnerability, which can be exploited by remote users to send services on the target system by sending specially crafted websocket traffic, causing the target system to refuse service. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. Security flaws exist in several F5 products. Attackers can exploit this vulnerability to compromise virtual server services. The following products and versions are affected: F5 BIG-IP LTM version 12.1.0 to 12.1.2; BIG-IP AAM version 12.1.0 to 12.1.2; BIG-IP AFM version 12.1.0 to 12.1.2; BIG-IP Analytics version 12.1.0 through 12.1.2; BIG-IP APM version 12.1.0 through 12.1.2; BIG-IP ASM version 12.1.0 through 12.1.2; BIG-IP DNS version 12.1.0 to version 12.1.2; BIG-IP Link Controller version 12.1.0 to version 12.1.2; BIG-IP PEM version 12.1.0 to version 12.1.2; BIG-IP WebSafe version 12.1.0 to version 12.1.2

Trust: 2.25

sources: NVD: CVE-2016-9253 // JVNDB: JVNDB-2016-008556 // CNVD: CNVD-2017-06376 // VULHUB: VHN-98073

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-06376

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.0	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.1.0	Trust: 1.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.2	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.1.2	Trust: 1.6
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.0	Trust: 1.6
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.1.1	Trust: 1.6
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.1.0	Trust: 1.6
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.1.2	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.1.1	Trust: 1.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.1	Trust: 1.6
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip advanced firewall manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip analytics	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip application acceleration manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip domain name system	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip link controller	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip local traffic manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip policy enforcement manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip websafe	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip	scope:	gte	version:	12.1.0,<=12.1.2	Trust: 0.6

sources: CNVD: CNVD-2017-06376 // JVNDB: JVNDB-2016-008556 // CNNVD: CNNVD-201705-500 // NVD: CVE-2016-9253

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-9253
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-9253
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-06376
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201705-500
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-98073
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-9253
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-06376
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-98073
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-9253
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-06376 // VULHUB: VHN-98073 // JVNDB: JVNDB-2016-008556 // CNNVD: CNNVD-201705-500 // NVD: CVE-2016-9253

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-98073 // JVNDB: JVNDB-2016-008556 // NVD: CVE-2016-9253

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201705-500

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201705-500

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-008556

PATCH

title:	K51351360: Websocket profile vulnerability CVE-2016-9253	url:	https://support.f5.com/csp/article/K51351360	Trust: 0.8
title:	Patch for F5BIG-IP Remote Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/93428	Trust: 0.6
title:	Multiple F5 Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70019	Trust: 0.6

sources: CNVD: CNVD-2017-06376 // JVNDB: JVNDB-2016-008556 // CNNVD: CNNVD-201705-500

EXTERNAL IDS

db:	NVD	id:	CVE-2016-9253	Trust: 3.1
db:	SECTRACK	id:	1038415	Trust: 1.7
db:	JVNDB	id:	JVNDB-2016-008556	Trust: 0.8
db:	CNNVD	id:	CNNVD-201705-500	Trust: 0.7
db:	CNVD	id:	CNVD-2017-06376	Trust: 0.6
db:	VULHUB	id:	VHN-98073	Trust: 0.1

sources: CNVD: CNVD-2017-06376 // VULHUB: VHN-98073 // JVNDB: JVNDB-2016-008556 // CNNVD: CNNVD-201705-500 // NVD: CVE-2016-9253

REFERENCES

url:	https://support.f5.com/csp/article/k51351360	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9253	Trust: 1.4
url:	http://www.securitytracker.com/id/1038415	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9253	Trust: 0.8
url:	http://securitytracker.com/id/1038415	Trust: 0.6

sources: CNVD: CNVD-2017-06376 // VULHUB: VHN-98073 // JVNDB: JVNDB-2016-008556 // CNNVD: CNNVD-201705-500 // NVD: CVE-2016-9253

SOURCES

db:	CNVD	id:	CNVD-2017-06376
db:	VULHUB	id:	VHN-98073
db:	JVNDB	id:	JVNDB-2016-008556
db:	CNNVD	id:	CNNVD-201705-500
db:	NVD	id:	CVE-2016-9253

LAST UPDATE DATE

2024-11-23T23:12:27.152000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-06376	date:	2017-05-12T00:00:00
db:	VULHUB	id:	VHN-98073	date:	2017-07-08T00:00:00
db:	JVNDB	id:	JVNDB-2016-008556	date:	2017-06-06T00:00:00
db:	CNNVD	id:	CNNVD-201705-500	date:	2017-05-10T00:00:00
db:	NVD	id:	CVE-2016-9253	date:	2024-11-21T03:00:51.407

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-06376	date:	2017-05-12T00:00:00
db:	VULHUB	id:	VHN-98073	date:	2017-05-09T00:00:00
db:	JVNDB	id:	JVNDB-2016-008556	date:	2017-06-06T00:00:00
db:	CNNVD	id:	CNNVD-201705-500	date:	2017-05-10T00:00:00
db:	NVD	id:	CVE-2016-9253	date:	2017-05-09T15:29:00.280