CVE-2017-6167
HighSummary
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.
Risk Assessment
The organization may be exposed to unauthorized command execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update the software to the latest version to eliminate these race conditions and minimize risk.
Other vulnerabilities in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
See all- CVE-2017-6133High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.
- CVE-2017-6145High
The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe versions 12.0.0 through 12.1.2 and 13.0.0 improperly re-validates BIGIPAuthCookie cookies when converting them to X-F5-Auth-Token tokens. This allows expired cookies to be converted into valid tokens.
Original NVD description (English source)
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.