CVE-2017-6145
HighSummary
The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe versions 12.0.0 through 12.1.2 and 13.0.0 improperly re-validates BIGIPAuthCookie cookies when converting them to X-F5-Auth-Token tokens. This allows expired cookies to be converted into valid tokens.
Risk Assessment
The organization may be exposed to unauthorized access as expired cookies can be used to obtain valid tokens, creating a security breach risk.
Recommendation
It is recommended to upgrade to the latest version of F5 BIG-IP software to mitigate this vulnerability and implement additional cookie validation mechanisms.
Other vulnerabilities in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
See all- CVE-2017-6167High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.
- CVE-2017-6133High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.
Original NVD description (English source)
iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.