Detections
Analytics

F5 Networks BIG-IP : HTTP/2 Settings Flood vulnerability (K50233772)

high Nessus Plugin ID 129315

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. (CVE-2019-9515)

Impact

The BIG-IP system may exhaust available resources and fail over to another system in the device group.

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K50233772.

See Also

https://my.f5.com/manage/s/article/K50233772

Plugin Details

Severity: High

ID: 129315

File Name: f5_bigip_SOL50233772.nasl

Version: 1.9

Type: local

Published: 9/25/2019

Updated: 11/2/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2019-9515

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_local_traffic_manager, cpe:/h:f5:big-ip

Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version

Exploit Ease: No known exploits are available

Patch Publication Date: 8/19/2019

Vulnerability Publication Date: 8/13/2019

Reference Information

CVE: CVE-2019-9515