SB2017102003 - Information disclosure in F5 BIG-IP
Published: October 20, 2017 Updated: October 26, 2017
Security Bulletin ID
SB2017102003
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2017-6165)
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.The weakness exists in F5 BIG-IP running on VIPRIONi due to the '/usr/bin/safenet-sync.sh' script to synchronize SafeNet External Network hardware security module (HSM) configuration elements between blades in a clustered deployment writes the HSM partition password in cleartext to the '/var/log/ltm' log file. A local attacker can obtain the SafeNet External Network HSM password.
Remediation
Install update from vendor's website.