A vulnerability exists in the TLS and DTLS protocols that may allow an attacker to recover plaintext from TLS/DTLS connections that use CBC-mode encryption. (CVE-2013-0169)

Note: Stream ciphers, such as RC4, are not vulnerable to this issue.

A SQL injection vulnerability exists in a BIG-IP component. This local vulnerability may allow an authenticated attacker to download arbitrary files from the file system.

An XML External Entity Injection (XXE) vulnerability exists in a BIG-IP component. This vulnerability may allow a user who is logged in to the BIG-IP Configuration utility to download arbitrary files from the file system.

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, also referred to as a CRIME attack. (CVE-2012-4929)

Impact

Connections to the BIG-IP Configuration utility are at risk.

Note: BIG-IP SSL profiles are not affected.

A cross-site scripting (XSS) vulnerability exists on the BIG-IP ASM traffic overview page. Malicious request URLs may be exposed in the Configuration utility without proper sanitization.

A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong.

A platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using secure shell (SSH). The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect.

The following platforms are affected by this issue :

VIPRION B2100, B4100, and B4200

BIG-IP 520, 540, 1000, 2000, 2400, 5000, 5100, 1600, 3600, 3900, 6900, 8900, 8950, 11000, and 11050

BIG-IP Virtual Edition

Enterprise Manager 3000 and 4000

Note : Systems that are licensed to run in Appliance mode on BIG-IP 10.2.1 HF3 or later are not susceptible to this vulnerability. For more information about Appliance mode, refer to K12815: Overview of Appliance mode.

The only sign that this vulnerability may have been exploited on an affected system would be the appearance of unexpected root login messages in the /var/log/secure file. However, there is no way to tell from any specific login message whether it was the result of this vulnerability. Further, it is possible for a privileged account to eliminate traces of illicit activity by modifying the log files.

Neither a strong password policy nor remote authentication helps mitigate the issue. For information about protecting your system from exploitation, refer to the Recommended Action section below.

F5 would like to acknowledge Florent Daigniere of Matta Consulting for bringing this issue to our attention, and for following the highest standards of responsible disclosure.

Impact

Privileged (root) access may be granted to unauthenticated users.

PHP versions prior to 5.3.9 compute hash values for form parameters without restricting the ability to trigger hash collisions predictably, which may allow remote attackers to cause a denial of service (DoS) (CPU consumption) by sending many crafted parameters.
(CVE-2011-4885)

PHP has been cited with the following multiple vulnerabilities, which may be locally exploitable on some F5 products :

CVE-2006-7243 PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.

CVE-2007-3799 The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.

CVE-2010-3710 Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.

CVE-2010-3870 The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

CVE-2010-4697 Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set,
__get, __isset, and __unset methods on objects accessed by a reference.

CVE-2011-1470 The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function.

CVE-2011-3182 PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.

CVE-2011-3267 PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors.

CVE-2011-3268 Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.

CVE-2011-4566 Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.

CVE-2012-0830 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.

The remote BIG-IP device is missing a patch required by a security advisory.

The ISC Dynamic Host Configuration Protocol (DHCP) client, dhclient ,in versions 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands by way of shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.

The byte-range filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial-of-service (memory and CPU consumption) using a Range header that expresses multiple overlapping ranges.

When this vulnerability is exploited, the httpd process consumes all available CPU cycles. As a result of CPU starvation, the Configuration utility, SSH sessions, and other userland processes may appear extremely slow or completely unresponsive. On BIG-IP systems, if the system hardware watchdog timer is not updated for more than 10 seconds, the hardware watchdog restarts the system. (CVE-2011-3192)

Impact

The performance of userland processes may be severely impaired, and the system may eventually reboot.

Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a Denial of Service (DoS) (named daemon crash) by way of a crafted UPDATE request.

Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets.

The strtod.c function may allow context-dependent attackers to cause a denial-of-service via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers.

The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer de-reference, related to the minor version number.

Unspecified vulnerability in ISC BIND 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, 9.7 beta before 9.7.0b3, and 9.0.x through 9.3.x with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks via additional sections in a response sent for resolution of a recursive client query, which is not properly handled when the response is processed 'at the same time as requesting DNSSEC records (DO).'

Sockstress DoS tool CVE-2008-4609. The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

ID	Name	Severity
78142	F5 Networks BIG-IP : TLS/DTLS 'Lucky 13' vulnerability (K14190)	low
78141	F5 Networks BIG-IP : SQL injection vulnerability from an authenticated source (SOL14154)	high
78140	F5 Networks BIG-IP : XML External Entity Injection (XXE) from authenticated source vulnerability (K14138)	medium
78139	F5 Networks BIG-IP : CRIME vulnerability via TLS 1.2 protocol (K14054)	low
78138	F5 Networks BIG-IP : XSS vulnerability (SOL13838)	medium
78137	F5 Networks BIG-IP : Hosts may generate weak RSA keys under low entropy conditions (SOL13607)	high
78136	F5 Networks BIG-IP : SSH vulnerability (K13600)	critical
78135	F5 Networks BIG-IP : PHP vulnerability (K13588)	medium
78134	F5 Networks BIG-IP : Multiple PHP vulnerabilities (K13519)	critical
78133	F5 Networks BIG-IP : TMM vulnerability (SOL13233)	high
78132	F5 Networks BIG-IP : DHCP Client vulnerability (SOL13219)	high
78131	F5 Networks BIG-IP : Apache Range header vulnerability (K13114)	high
78130	F5 Networks BIG-IP : BIND vulnerability (SOL12986)	medium
78129	F5 Networks BIG-IP : BIND vulnerability (SOL12985)	medium
78128	F5 Networks BIG-IP : XSS vulnerability in BIG-IP ASM Web Scraping feature (SOL12953)	medium
78127	F5 Networks BIG-IP : PHP vulnerability (SOL12650)	medium
78126	F5 Networks BIG-IP : OpenSSL vulnerability (SOL11533)	medium
78125	F5 Networks BIG-IP : BIND 9 vulnerability (SOL11503)	medium
78124	F5 Networks BIG-IP : DNSSEC BIND vulnerability (SOL10898)	low
78123	F5 Networks BIG-IP : SSL Renegotiation vulnerability (SOL10737)	medium
78122	F5 Networks BIG-IP : Netscape reuse cipher change bug (SOL10674)	high
78121	F5 Networks BIG-IP : Sockstress DoS tool vulnerability (SOL10509)	high
78120	F5 Networks BIG-IP : BIG-IP ASM and PSM remote buffer overflow exploit (SOL10417)	medium
78119	F5 Networks BIG-IP : BIND vulnerability (SOL10366)	medium

Detections

Analytics

F5 Networks Local Security Checks Family for Nessus

low

high

medium

low

medium

high

critical

medium

critical

high

high

high

medium

medium

medium

medium

medium

medium

low

medium

high

high

medium

medium