ID

VAR-201804-0509


CVE

CVE-2017-6155


TITLE

plural F5 BIG-IP Data processing vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-013268

DESCRIPTION

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure. plural F5 BIG-IP The product contains data processing vulnerabilities.Service operation interruption (DoS) There is a possibility of being put into a state. F5BIG-IPLTM and other products are products of American F5 Company. F5BIG-IPLTM is a local traffic manager; BIG-IPAAM is an application acceleration manager. There are security vulnerabilities in several F5 products. An attacker could exploit the vulnerability by sending a malformed SPDY or HTTP/2 request to cause a denial of service. F5 BIG-IP LTM, etc. The following products and versions are affected: F5 BIG-IP LTM Release 13.0.0, Release 12.0.0 to Release 12.1.3.1, Release 11.6.0 to Release 11.6.2, Release 11.4.1 to Release 11.5.5, Release 11.2.1 Versions; BIG-IP AAM Version 13.0.0, Version 12.0.0 to Version 12.1.3.1, Version 11.6.0 to Version 11.6.2, Version 11.4.1 to Version 11.5.5, Version 11.2.1; BIG-IP AFM Version 13.0.0, Version 12.0.0 to Version 12.1.3.1, Version 11.6.0 to Version 11.6.2, Version 11.4.1 to Version 11.5.5, Version 11.2.1; BIG-IP APM Version 13.0.0, Version 12.0 .0 to 12.1.3.1, 11.6.0 to 11.6.2, 11.4.1 to 11.5.5, 11.2.1; BIG-IP ASM 13.0.0, 12.0.0 to 12.1. Version 3.1, Version 11.6.0 to Version 11.6.2, Version 11.4.1 to Version 11.5.5, Version 11.2.1; BIG-IP Edge Gateway Version 13.0.0, Version 12.0.0 to Version 12.1.3.1, Version 11.6. 0 to 11.6.2, 11.4.1 to 11.5.5, 11.2.1; BIG-IP Link Controller 13.0.0, 12.0.0 to 12.1.3.1, 11.6.0 to 11.6. 2 versions, 11.4.1 to 11.5.5, 11.2.1; BIG-IP PEM 13.0.0, 12.0.0 to 12.1.3.1, 11.6.0 to 11.6.2, 11.4.1 Version to version 11.5.5, version 11.2.1; BIG-IP PSM 13.0

Trust: 2.25

sources: NVD: CVE-2017-6155 // JVNDB: JVNDB-2017-013268 // CNVD: CNVD-2018-09412 // VULHUB: VHN-114358

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-09412

AFFECTED PRODUCTS

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.2.1

Trust: 2.4

vendor:f5model:big-ip protocol security modulescope:eqversion:11.2.1

Trust: 2.4

vendor:f5model:big-ip protocol security modulescope:eqversion:13.0.0

Trust: 2.4

vendor:f5model:big-ip websafescope:eqversion:13.0.0

Trust: 2.4

vendor:f5model:big-ip access policy managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip access policy managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip application security managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip application security managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip link controllerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip link controllerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip local traffic managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip websafescope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip protocol security modulescope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip websafescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip websafescope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip websafescope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip websafescope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip websafescope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip websafescope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip protocol security modulescope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip protocol security modulescope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip protocol security modulescope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip websafescope:eqversion:11.4.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip websafescope:eqversion:11.6.0 to 11.6.2

Trust: 0.8

vendor:f5model:big-ip websafescope:eqversion:12.0.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ipscope:eqversion:11.2.1

Trust: 0.6

vendor:f5model:big-ipscope:eqversion:13.0.0

Trust: 0.6

vendor:f5model:big-ipscope:gteversion:12.0.0<=12.1.3.1

Trust: 0.6

vendor:f5model:big-ipscope:gteversion:11.6.0<=11.6.2

Trust: 0.6

vendor:f5model:big-ipscope:gteversion:11.4.1<=11.5.5

Trust: 0.6

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.5.1

Trust: 0.6

vendor:f5model:big-ip websafescope:eqversion:11.5.3

Trust: 0.6

vendor:f5model:big-ip websafescope:eqversion:11.5.4

Trust: 0.6

vendor:f5model:big-ip websafescope:eqversion:11.6.1

Trust: 0.6

vendor:f5model:big-ip websafescope:eqversion:12.1.0

Trust: 0.6

vendor:f5model:big-ip websafescope:eqversion:11.5.2

Trust: 0.6

sources: CNVD: CNVD-2018-09412 // JVNDB: JVNDB-2017-013268 // CNNVD: CNNVD-201804-711 // NVD: CVE-2017-6155

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6155
value: HIGH

Trust: 1.0

NVD: CVE-2017-6155
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-09412
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201804-711
value: HIGH

Trust: 0.6

VULHUB: VHN-114358
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-6155
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-09412
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-114358
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6155
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-09412 // VULHUB: VHN-114358 // JVNDB: JVNDB-2017-013268 // CNNVD: CNNVD-201804-711 // NVD: CVE-2017-6155

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-19

Trust: 0.9

sources: VULHUB: VHN-114358 // JVNDB: JVNDB-2017-013268 // NVD: CVE-2017-6155

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201804-711

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201804-711

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-013268

PATCH

title:K10930474url:https://support.f5.com/csp/article/K10930474

Trust: 0.8

title:Patch for multiple F5 product denial of service vulnerabilities (CNVD-2018-09412)url:https://www.cnvd.org.cn/patchInfo/show/128533

Trust: 0.6

title:Multiple F5 Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80119

Trust: 0.6

sources: CNVD: CNVD-2018-09412 // JVNDB: JVNDB-2017-013268 // CNNVD: CNNVD-201804-711

EXTERNAL IDS

db:NVDid:CVE-2017-6155

Trust: 3.1

db:JVNDBid:JVNDB-2017-013268

Trust: 0.8

db:CNVDid:CNVD-2018-09412

Trust: 0.6

db:CNNVDid:CNNVD-201804-711

Trust: 0.6

db:VULHUBid:VHN-114358

Trust: 0.1

sources: CNVD: CNVD-2018-09412 // VULHUB: VHN-114358 // JVNDB: JVNDB-2017-013268 // CNNVD: CNNVD-201804-711 // NVD: CVE-2017-6155

REFERENCES

url:https://support.f5.com/csp/article/k10930474

Trust: 2.3

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6155

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2017-6155

Trust: 0.8

sources: CNVD: CNVD-2018-09412 // VULHUB: VHN-114358 // JVNDB: JVNDB-2017-013268 // CNNVD: CNNVD-201804-711 // NVD: CVE-2017-6155

SOURCES

db:CNVDid:CNVD-2018-09412
db:VULHUBid:VHN-114358
db:JVNDBid:JVNDB-2017-013268
db:CNNVDid:CNNVD-201804-711
db:NVDid:CVE-2017-6155

LAST UPDATE DATE

2024-11-23T22:26:25.416000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2018-09412date:2018-05-14T00:00:00
db:VULHUBid:VHN-114358date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2017-013268date:2018-06-14T00:00:00
db:CNNVDid:CNNVD-201804-711date:2019-10-23T00:00:00
db:NVDid:CVE-2017-6155date:2024-11-21T03:29:09.487

SOURCES RELEASE DATE

db:CNVDid:CNVD-2018-09412date:2018-05-14T00:00:00
db:VULHUBid:VHN-114358date:2018-04-13T00:00:00
db:JVNDBid:JVNDB-2017-013268date:2018-06-14T00:00:00
db:CNNVDid:CNNVD-201804-711date:2018-04-16T00:00:00
db:NVDid:CVE-2017-6155date:2018-04-13T13:29:00.330