Denial of service in BIG-IP MPTCP



Published: 2021-03-11

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Resource exhaustion

EUVDB-ID: #VU51418

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-23004

CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing multipath TCP (MPTCP) forwarding flows on standard virtual servers without MPTCP enabled in the applied TCP profile. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BIG-IP: 11.6.1 - 16.0.1

BIG-IP LTM: 11.6.1 - 16.0.1

BIG-IP AAM: 11.6.1 - 16.0.1

BIG-IP Advanced WAF: 11.6.1 - 16.0.1

BIG-IP AFM: 11.6.1 - 16.0.1

BIG-IP Analytics: 11.6.1 - 16.0.1

BIG-IP APM: 11.6.1 - 16.0.1

BIG-IP ASM: 11.6.1 - 16.0.1

BIG-IP DDHD: 11.6.1 - 16.0.1

BIG-IP DNS: 11.6.1 - 16.0.1

BIG-IP FPS: 11.6.1 - 16.0.1

BIG-IP GTM: 11.6.1 - 16.0.1

BIG-IP Link Controller: 11.6.1 - 16.0.1

BIG-IP PEM: 11.6.1 - 16.0.1

BIG-IP SSLO: 11.6.1 - 16.0.1


CPE2.3 External links

http://support.f5.com/csp/article/K31025212

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###