Details of VAR-202109-0787

ID

VAR-202109-0787

CVE

CVE-2021-23049

TITLE

plural F5 Networks Product resource exhaustion vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-011976

DESCRIPTION

On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed requests can cause an increase in Traffic Management Microkernel (TMM) memory utilization resulting in an out-of-memory condition and a denial-of-service (DoS). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. plural F5 Networks The product contains a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. F5 BIG-IP has a security vulnerability. The vulnerability stems from the ability to modify and increase the request or response body size when using decompressors, json transcoders, grpc web, or other proprietary extensions. An attacker could exploit this vulnerability to read invalid memory and cause a crash, resulting in a denial of service

Trust: 1.8

sources: NVD: CVE-2021-23049 // JVNDB: JVNDB-2021-011976 // VULHUB: VHN-381535 // VULMON: CVE-2021-23049

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip link controller	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip fraud protection service	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip analytics	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip fraud protection service	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip analytics	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip global traffic manager	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip fraud protection service	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip global traffic manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip global traffic manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip global traffic manager	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip fraud protection service	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip analytics	scope:	gte	version:	16.0.0	Trust: 1.0
vendor:	f5	model:	big-ip domain name system	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	lt	version:	16.0.1.2	Trust: 1.0
vendor:	f5	model:	big-ip analytics	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip global traffic manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip advanced firewall manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip analytics	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip advanced web application firewall	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip local traffic manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip application acceleration manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip fraud protection service	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip domain name system	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-011976 // NVD: CVE-2021-23049

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-23049
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-23049
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202108-2294
value:	HIGH
Trust: 0.6
VULHUB:	VHN-381535
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2021-23049
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-23049
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-381535
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-23049
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2021-23049
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-381535 // VULMON: CVE-2021-23049 // JVNDB: JVNDB-2021-011976 // CNNVD: CNNVD-202108-2294 // NVD: CVE-2021-23049

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.1
problemtype:	Resource exhaustion (CWE-400) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-381535 // JVNDB: JVNDB-2021-011976 // NVD: CVE-2021-23049

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-2294

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202108-2294

PATCH

title:	K65397301	url:	https://support.f5.com/csp/article/K65397301	Trust: 0.8
title:	F5 BIG-IP Remediation of resource management error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=163748	Trust: 0.6

sources: JVNDB: JVNDB-2021-011976 // CNNVD: CNNVD-202108-2294

EXTERNAL IDS

db:	NVD	id:	CVE-2021-23049	Trust: 3.4
db:	JVNDB	id:	JVNDB-2021-011976	Trust: 0.8
db:	CNNVD	id:	CNNVD-202108-2294	Trust: 0.7
db:	AUSCERT	id:	ESB-2021.2867	Trust: 0.6
db:	VULHUB	id:	VHN-381535	Trust: 0.1
db:	VULMON	id:	CVE-2021-23049	Trust: 0.1

sources: VULHUB: VHN-381535 // VULMON: CVE-2021-23049 // JVNDB: JVNDB-2021-011976 // CNNVD: CNNVD-202108-2294 // NVD: CVE-2021-23049

REFERENCES

url:	https://support.f5.com/csp/article/k65397301	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-23049	Trust: 1.4
url:	https://www.auscert.org.au/bulletins/esb-2021.2867	Trust: 0.6
url:	https://vigilance.fr/vulnerability/f5-big-ip-memory-leak-via-irules-resolver-summarize-36205	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/400.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-381535 // VULMON: CVE-2021-23049 // JVNDB: JVNDB-2021-011976 // CNNVD: CNNVD-202108-2294 // NVD: CVE-2021-23049

SOURCES

db:	VULHUB	id:	VHN-381535
db:	VULMON	id:	CVE-2021-23049
db:	JVNDB	id:	JVNDB-2021-011976
db:	CNNVD	id:	CNNVD-202108-2294
db:	NVD	id:	CVE-2021-23049

LAST UPDATE DATE

2024-08-14T13:43:23.980000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-381535	date:	2021-09-24T00:00:00
db:	VULMON	id:	CVE-2021-23049	date:	2021-09-24T00:00:00
db:	JVNDB	id:	JVNDB-2021-011976	date:	2022-08-19T04:41:00
db:	CNNVD	id:	CNNVD-202108-2294	date:	2021-09-26T00:00:00
db:	NVD	id:	CVE-2021-23049	date:	2021-09-24T15:02:51.520

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-381535	date:	2021-09-14T00:00:00
db:	VULMON	id:	CVE-2021-23049	date:	2021-09-14T00:00:00
db:	JVNDB	id:	JVNDB-2021-011976	date:	2022-08-19T00:00:00
db:	CNNVD	id:	CNNVD-202108-2294	date:	2021-08-24T00:00:00
db:	NVD	id:	CVE-2021-23049	date:	2021-09-14T13:15:11.033