Details of VAR-201712-0225

ID

VAR-201712-0225

CVE

CVE-2017-0304

TITLE

F5 BIG-IP AFM Management UI In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-011581

DESCRIPTION

A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected. F5 BIG-IP AFM Management UI Is SQL An injection vulnerability exists.Information may be obtained and information may be altered. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. F5 BIG-IP AFM 12.0.0 through 12.1.2 and 13.0.0 are vulnerable. F5 BIG-IP Advanced Firewall Manager (AFM) is a firewall manager from F5 Corporation in the United States that can be extended to prevent high-volume DDoS attacks that can overwhelm load balancers, firewalls, and even networks. Configuration utility is a configuration tool. A remote attacker could exploit this vulnerability to tamper with a copy of the configured firewall

Trust: 1.98

sources: NVD: CVE-2017-0304 // JVNDB: JVNDB-2017-011581 // BID: 102332 // VULHUB: VHN-99123

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.0.0	Trust: 2.4
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.0	Trust: 2.4
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.1	Trust: 2.4
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	12.1.2	Trust: 2.4
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	13.0.0	Trust: 2.4
vendor:	f5	model:	big-ip afm	scope:	eq	version:	13.0	Trust: 0.3
vendor:	f5	model:	big-ip afm	scope:	eq	version:	12.1.2	Trust: 0.3
vendor:	f5	model:	big-ip afm	scope:	eq	version:	12.1.1	Trust: 0.3
vendor:	f5	model:	big-ip afm	scope:	eq	version:	12.0	Trust: 0.3
vendor:	f5	model:	big-ip afm	scope:	eq	version:	12.1.0	Trust: 0.3
vendor:	f5	model:	big-ip afm	scope:	ne	version:	13.1	Trust: 0.3
vendor:	f5	model:	big-ip afm hf1	scope:	ne	version:	13.0	Trust: 0.3
vendor:	f5	model:	big-ip afm	scope:	ne	version:	12.1.3	Trust: 0.3

sources: BID: 102332 // JVNDB: JVNDB-2017-011581 // CNNVD: CNNVD-201712-835 // NVD: CVE-2017-0304

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-0304
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-0304
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201712-835
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-99123
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-0304
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-99123
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-0304
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.5
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-99123 // JVNDB: JVNDB-2017-011581 // CNNVD: CNNVD-201712-835 // NVD: CVE-2017-0304

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.9

sources: VULHUB: VHN-99123 // JVNDB: JVNDB-2017-011581 // NVD: CVE-2017-0304

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201712-835

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201712-835

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-011581

PATCH

title:	K39428424	url:	https://support.f5.com/csp/article/K39428424	Trust: 0.8
title:	F5 BIG-IP Advanced Firewall Manager Configuration utility SQL Repair measures for injecting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=77288	Trust: 0.6

sources: JVNDB: JVNDB-2017-011581 // CNNVD: CNNVD-201712-835

EXTERNAL IDS

db:	NVD	id:	CVE-2017-0304	Trust: 2.8
db:	BID	id:	102332	Trust: 1.4
db:	SECTRACK	id:	1040041	Trust: 1.1
db:	JVNDB	id:	JVNDB-2017-011581	Trust: 0.8
db:	CNNVD	id:	CNNVD-201712-835	Trust: 0.7
db:	VULHUB	id:	VHN-99123	Trust: 0.1

sources: VULHUB: VHN-99123 // BID: 102332 // JVNDB: JVNDB-2017-011581 // CNNVD: CNNVD-201712-835 // NVD: CVE-2017-0304

REFERENCES

url:	https://support.f5.com/csp/article/k39428424	Trust: 2.0
url:	http://www.securityfocus.com/bid/102332	Trust: 1.1
url:	http://www.securitytracker.com/id/1040041	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-0304	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-0304	Trust: 0.8
url:	http://www.f5.com/products/big-ip/	Trust: 0.3

sources: VULHUB: VHN-99123 // BID: 102332 // JVNDB: JVNDB-2017-011581 // CNNVD: CNNVD-201712-835 // NVD: CVE-2017-0304

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 102332

SOURCES

db:	VULHUB	id:	VHN-99123
db:	BID	id:	102332
db:	JVNDB	id:	JVNDB-2017-011581
db:	CNNVD	id:	CNNVD-201712-835
db:	NVD	id:	CVE-2017-0304

LAST UPDATE DATE

2024-11-23T22:22:20.717000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-99123	date:	2018-01-08T00:00:00
db:	BID	id:	102332	date:	2017-12-20T00:00:00
db:	JVNDB	id:	JVNDB-2017-011581	date:	2018-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201712-835	date:	2017-12-22T00:00:00
db:	NVD	id:	CVE-2017-0304	date:	2024-11-21T03:02:43.793

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-99123	date:	2017-12-21T00:00:00
db:	BID	id:	102332	date:	2017-12-20T00:00:00
db:	JVNDB	id:	JVNDB-2017-011581	date:	2018-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201712-835	date:	2017-12-22T00:00:00
db:	NVD	id:	CVE-2017-0304	date:	2017-12-21T17:29:00.263