CVE-2017-6162
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 1…
Published 9 y ago · modified 4 mo ago · JSON
Summary
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the peer device.
Exploit prediction (EPSS)
1.67% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Affected products
- F5 Networks, Inc. BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securityfocus.com /bid/101635 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039673 · vdb-entry, x_refsource_SECTRACK, x_transferred
- support.f5.com /csp/article/K13421245 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-6162
- NVD: CVE-2017-6162
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.