F5 Networks BIG-IP : OpenSSL SSL_get_shared_ciphers vulnerability (SOL8106)
critical Nessus Plugin ID 86017
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote device is missing a vendor-supplied security patch.Description
F5 Product Development has determined that the BIG-IP and Enterprise Manager products use a vulnerable version of OpenSSL; however, the vulnerable code is not used in either TMM or in Apache on the BIG-IP system. The vulnerability is considered to be a local vulnerability and cannot be exploited remotely.Solution
Upgrade to one of the non-vulnerable versions listed in the F5 Solution SOL8106.See Also
Plugin Details
Severity: Critical
ID: 86017
File Name: f5_bigip_SOL8106.nasl
Version: 2.10
Type: local
Published: 9/18/2015
Updated: 1/11/2021
Dependencies: f5_bigip_detect.nbin
Configuration: Enable paranoid mode
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:POC/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip
Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/15/2007
Reference Information
CVE: CVE-2006-2937, CVE-2006-2940, CVE-2006-3738, CVE-2006-4343, CVE-2007-5135
BID: 25831