Quantum Secular Labs / Blog / Advisories

CVE-2016-5022: F5 Big Iq Cloud: Denial of service

CVE-2016-5022 is rated critical with a CVSS v3.0 base score of 9.8 and affects F5 Big Iq Cloud, along with 16 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.x before 11.2.1 HF16 and 11.3.0; BIG-IP GTM 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, and 11.6.x before 11.6.1 HF1; BIG-IP PSM 11.2.x before 11.2.1 HF16, 11.3.x, and 11.4.0 through 11.4.1; Enterprise Manager 3.1.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 5.0.0; BIG-IQ Cloud and Orchestration 1.0.0; and iWorkflow 2.0.0, when Packet Filtering is enabled on virtual servers and possibly self IP addresses, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) and possibly have unspecified other impact via crafted network traffic.

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected products

  • F5 Big Iq Cloud: 4.0.0; 4.1.0; 4.2.0; 4.3.0; 4.4.0; 4.5.0
  • F5 Big Iq Device: 4.2.0; 4.3.0; 4.4.0; 4.5.0
  • F5 Big Iq Centralized Management: 4.6.0
  • F5 Big Iq Cloud And Orchestration: 1.0.0
  • F5 Big IP Edge Gateway: 11.2.0; 11.2.1; 11.3.0
  • F5 Enterprise Manager: 3.1.1
  • F5 Big IP Link Controller: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1
  • F5 Big IP Policy Enforcement Manager: 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1; 12.0.0
  • F5 Big IP Access Policy Manager: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1
  • F5 Big IP Global Traffic Manager: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1
  • F5 Big IP Webaccelerator: 11.2.0; 11.2.1; 11.3.0
  • F5 Big Iq Application Delivery Controller: 4.5.0
  • F5 Big IP Application Security Manager: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1
  • F5 Big IP Local Traffic Manager: 11.2.0; 11.2.1; 11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.5.2; 11.5.3; 11.5.4; 11.6.0; 11.6.1
  • F5 Big IP WAN Optimization Manager: 11.2.0; 11.2.1; 11.3.0

References