Details of VAR-201705-3521

ID

VAR-201705-3521

CVE

CVE-2016-9251

TITLE

plural F5 BIG-IP Vulnerabilities related to authorization, authority, and access control in products

Trust: 0.8

sources: JVNDB: JVNDB-2016-008555

DESCRIPTION

In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection. plural F5 BIG-IP The product contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. F5BIG-IP is a load balancer that uses a variety of allocation algorithms to distribute network requests to available servers in a server cluster. By managing incoming web data traffic and increasing effective network bandwidth, network visitors get as much as possible. The hardware device for the best networking experience. F5BIG-IPiControlREST has a remote privilege elevation vulnerability that allows remote authenticated users to issue a specially crafted iControlREST connection to gain elevated privileges on the target system. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. Security flaws exist in several F5 products. The following products and versions are affected: F5 BIG-IP LTM version 12.0.0 to 12.1.2; BIG-IP AAM version 12.0.0 to 12.1.2; BIG-IP AFM version 12.0.0 to 12.1.2; BIG-IP Analytics version 12.0.0 through 12.1.2; BIG-IP APM version 12.0.0 through 12.1.2; BIG-IP ASM version 12.0.0 through 12.1.2; BIG-IP DNS version 12.0.0 to version 12.1.2; BIG-IP Link Controller version 12.0.0 to version 12.1.2; BIG-IP PEM version 12.0.0 to version 12.1.2; BIG-IP WebSafe version 12.0.0 to version 12.1.2

Trust: 2.25

sources: NVD: CVE-2016-9251 // JVNDB: JVNDB-2016-008555 // CNVD: CNVD-2017-06375 // VULHUB: VHN-98071

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-06375

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.0.0	Trust: 1.6
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.1	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.1.0	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.1.2	Trust: 1.6
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.0	Trust: 1.6
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.2	Trust: 1.6
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.0.0	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	12.1.1	Trust: 1.6
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.0.0	Trust: 1.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.1	Trust: 1.6
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip websafe	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.1.1	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	eq	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	12.1.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip advanced firewall manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip analytics	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip application acceleration manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip domain name system	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip link controller	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip local traffic manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip policy enforcement manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip websafe	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip	scope:	gte	version:	12.0.0<=12.1.2	Trust: 0.6

sources: CNVD: CNVD-2017-06375 // JVNDB: JVNDB-2016-008555 // CNNVD: CNNVD-201705-501 // NVD: CVE-2016-9251

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-9251
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-9251
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-06375
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201705-501
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-98071
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-9251
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-06375
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-98071
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-9251
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-06375 // VULHUB: VHN-98071 // JVNDB: JVNDB-2016-008555 // CNNVD: CNNVD-201705-501 // NVD: CVE-2016-9251

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-98071 // JVNDB: JVNDB-2016-008555 // NVD: CVE-2016-9251

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201705-501

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201705-501

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-008555

PATCH

title:	K41107914: iControl REST vulnerability CVE-2016-9251	url:	https://support.f5.com/csp/article/K41107914	Trust: 0.8
title:	Patch for F5BIG-IPiControlREST Remote Privilege Escalation Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/93426	Trust: 0.6
title:	Multiple F5 Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70020	Trust: 0.6

sources: CNVD: CNVD-2017-06375 // JVNDB: JVNDB-2016-008555 // CNNVD: CNNVD-201705-501

EXTERNAL IDS

db:	NVD	id:	CVE-2016-9251	Trust: 3.1
db:	SECTRACK	id:	1038414	Trust: 1.7
db:	JVNDB	id:	JVNDB-2016-008555	Trust: 0.8
db:	CNNVD	id:	CNNVD-201705-501	Trust: 0.7
db:	CNVD	id:	CNVD-2017-06375	Trust: 0.6
db:	VULHUB	id:	VHN-98071	Trust: 0.1

sources: CNVD: CNVD-2017-06375 // VULHUB: VHN-98071 // JVNDB: JVNDB-2016-008555 // CNNVD: CNNVD-201705-501 // NVD: CVE-2016-9251

REFERENCES

url:	https://support.f5.com/csp/article/k41107914	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9251	Trust: 1.4
url:	http://www.securitytracker.com/id/1038414	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9251	Trust: 0.8
url:	http://securitytracker.com/id/1038414	Trust: 0.6

sources: CNVD: CNVD-2017-06375 // VULHUB: VHN-98071 // JVNDB: JVNDB-2016-008555 // CNNVD: CNNVD-201705-501 // NVD: CVE-2016-9251

SOURCES

db:	CNVD	id:	CNVD-2017-06375
db:	VULHUB	id:	VHN-98071
db:	JVNDB	id:	JVNDB-2016-008555
db:	CNNVD	id:	CNNVD-201705-501
db:	NVD	id:	CVE-2016-9251

LAST UPDATE DATE

2024-11-23T22:34:38.544000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-06375	date:	2017-05-12T00:00:00
db:	VULHUB	id:	VHN-98071	date:	2017-07-08T00:00:00
db:	JVNDB	id:	JVNDB-2016-008555	date:	2017-06-06T00:00:00
db:	CNNVD	id:	CNNVD-201705-501	date:	2017-05-10T00:00:00
db:	NVD	id:	CVE-2016-9251	date:	2024-11-21T03:00:51.157

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-06375	date:	2017-05-12T00:00:00
db:	VULHUB	id:	VHN-98071	date:	2017-05-09T00:00:00
db:	JVNDB	id:	JVNDB-2016-008555	date:	2017-06-06T00:00:00
db:	CNNVD	id:	CNNVD-201705-501	date:	2017-05-10T00:00:00
db:	NVD	id:	CVE-2016-9251	date:	2017-05-09T15:29:00.250