SB2016121602 - Remote denial of service in F5 BIG-IP products
Published: December 16, 2016 Updated: January 10, 2019
Security Bulletin ID
SB2016121602
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Denial of service (CVE-ID: CVE-2016-5024)
The vulnerability allows a remote attacker to cause denial of service conditions.The vulnerability exists due to an input validation error within virtual server when parsing RADIUS messages via an iRule. A remote attacker can send specially crafted network packets to vulnerable device and cause denial of service.
Successful exploitation of the vulnerability may allow an attacker to cause Traffic Management Microkernel (TMM) process to stop responding.
Remediation
Install update from vendor's website.