F5 Networks BIG-IP : BIG-IP SSL vulnerability (K21905460) (ROBOT)

high Nessus Plugin ID 104687
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.


The remote device is missing a vendor-supplied security patch.


On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's private key itself, aka a ROBOT attack. (CVE-2017-6168)


Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.

Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require millions of server requests, during the handshake phase of the targeted sessionwithin the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the virtual server. The limited window of opportunity, limitations in bandwidth, and latencymake this attack significantly more difficult to execute.

This vulnerability affects BIG-IP systems with the following configuration :

A virtual server associated with a Client SSL profile with RSA key exchange enabled; RSA key exchange is enabled by default.Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.

Important :

Virtual servers configured with a Client SSL profile with the Generic Alert option disabled (enabled by default) are at higher risk because they report the specific handshake failure instead of a generic message.

Virtual servers configured with a Client SSL profile that has the Client Certificate option under the Client Authentication section set to require will limit the threat to attackers that are able to successfully authenticate first. Without client certificate authentication, this attack is unauthenticated andanonymous.

Virtual servers that have completely disabled RSA Key Exchange cipher suites within the Client SSL profile (for example, cipher string DEFAULT:!RSA ) are NOT impacted by this vulnerability.

BIG-IP Configuration utility, iControl services, big3d collection agent, and Centralized Management Infrastructure (CMI) connections are NOT impacted by this vulnerability.

Captured traffic from sessions using Perfect Forward Secrecy (PFS) cipher suites (DHE or ECDHE) cannot be decrypted due to this vulnerability.

This vulnerability is not an RSA private key recovery attack and does not compromise the servers private key.


Upgrade to one of the non-vulnerable versions listed in the F5 Solution K21905460.

See Also


Plugin Details

Severity: High

ID: 104687

File Name: f5_bigip_SOL21905460.nasl

Version: 3.16

Type: local

Published: 11/20/2017

Updated: 7/17/2019

Dependencies: f5_bigip_detect.nbin

Configuration: Enable paranoid mode

Risk Information


Risk Factor: Medium

Score: 5.2


Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C


Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/h:f5:big-ip

Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 11/17/2017

Vulnerability Publication Date: 11/17/2017

Reference Information

CVE: CVE-2017-6168