SB2021032619 - Multiple vulnerabilities in Intel E810 Ethernet Controllers in F5OS

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2020-24497)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the firmware. A local administrator can bypass implemented security restrictions and cause a denial of service (DoS) condition on the target system.

2) Buffer overflow (CVE-ID: CVE-2020-24498)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the firmware. A local administrator can trigger memory corruption and cause a denial of service condition on the target system.

3) Buffer overflow (CVE-ID: CVE-2020-24500)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the firmware. A local administrator can trigger memory corruption and cause a denial of service condition on the target system.

4) Buffer overflow (CVE-ID: CVE-2020-24501)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the firmware. A remote administrator on the local network can trigger memory corruption and cause a denial of service condition on the target system.

5) Input validation error (CVE-ID: CVE-2020-24505)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://support.f5.com/csp/article/K85738358