BID:98478

Multiple F5 BIG-IP Products CVE-2016-9250 Security Bypass Vulnerability

Info

Multiple F5 BIG-IP Products CVE-2016-9250 Security Bypass Vulnerability

Bugtraq ID:	98478
Class:	Configuration Error
CVE:	CVE-2016-9250
Remote:	Yes
Local:	No
Published:	May 16 2017 12:00AM
Updated:	May 16 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	F5 BIG-IP WebSafe 12.0 HF1 F5 BIG-IP WebSafe 12.0 F5 BIG-IP WebSafe 11.6 F5 BIG-IP WebAccelerator 11.2.1 HF15 F5 BIG-IP WebAccelerator 11.2.1 F5 BIG-IP PSM 11.4.1 F5 BIG-IP PSM 11.4 F5 BIG-IP PEM 12.0 F5 BIG-IP PEM 11.5.4 HF1 F5 BIG-IP PEM 11.4 F5 BIG-IP PEM 12.0.0 HF1 F5 BIG-IP PEM 11.6.0 F5 BIG-IP LTM 12.0 F5 BIG-IP LTM 11.5.4 HF1 F5 BIG-IP LTM 11.4 F5 BIG-IP LTM 11.2.1 HF15 F5 BIG-IP LTM 12.0.0 HF1 F5 BIG-IP LTM 11.6.0 F5 BIG-IP LTM 11.2.1 F5 BIG-IP Link Controller 12.0 F5 BIG-IP Link Controller 11.6 F5 BIG-IP Link Controller 11.5.4 HF1 F5 BIG-IP Link Controller 11.2.1 HF15 F5 BIG-IP Link Controller 11.2.1 F5 BIG-IP Link Controller 12.0.0 HF1 F5 BIG-IP GTM 11.5.4 HF1 F5 BIG-IP GTM 11.4 F5 BIG-IP GTM 11.2.1 HF15 F5 BIG-IP GTM 11.6.0 F5 BIG-IP GTM 11.2.1 F5 BIG-IP Edge Gateway 11.2.1 HF15 F5 BIG-IP Edge Gateway 11.2.1 F5 BIG-IP DNS 12.0 F5 BIG-IP DNS 12.0.0 HF1 F5 BIG-IP ASM 12.0 F5 BIG-IP ASM 11.5.4 HF1 F5 BIG-IP ASM 11.4 F5 BIG-IP ASM 11.2.1 HF15 F5 BIG-IP ASM 12.0.0 HF1 F5 BIG-IP ASM 11.6.0 F5 BIG-IP ASM 11.2.1 F5 BIG-IP APM 12.0 F5 BIG-IP APM 11.5.4 HF1 F5 BIG-IP APM 12.0.0 HF1 F5 BIG-IP APM 11.6.0 F5 BIG-IP APM 11.4.0 F5 BIG-IP APM 11.2.1 HF5 F5 BIG-IP APM 11.2.1 F5 BIG-IP Analytics 12.0 F5 BIG-IP Analytics 11.5.4 HF1 F5 BIG-IP Analytics 11.4 F5 BIG-IP Analytics 11.2.1 HF15 F5 BIG-IP Analytics 11.2.1 F5 BIG-IP Analytics 12.0.0 HF1 F5 BIG-IP Analytics 11.6.0 F5 BIG-IP AFM 12.0 F5 BIG-IP AFM 11.5.4 HF1 F5 BIG-IP AFM 11.4 F5 BIG-IP AFM 11.2.1 F5 BIG-IP AFM 12.0.0 HF1 F5 BIG-IP AFM 11.6.0 F5 BIG-IP AAM 12.0 F5 BIG-IP AAM 11.5.4 HF1 F5 BIG-IP AAM 11.2.1 F5 BIG-IP AAM 12.0.0 HF1 F5 BIG-IP AAM 11.6.0 F5 BIG-IP AAM 11.4.0

Not Vulnerable:	F5 BIG-IP WebSafe 13.0 F5 BIG-IP WebSafe 12.1.2 HF1 F5 BIG-IP PEM 13.0 F5 BIG-IP PEM 12.1.2 HF1 F5 BIG-IP PEM 11.6.1 HF2 F5 BIG-IP PEM 11.5.4 HF3 F5 BIG-IP LTM 13.0 F5 BIG-IP LTM 12.1.2 HF1 F5 BIG-IP LTM 11.6.1 HF2 F5 BIG-IP LTM 11.5.4 HF3 F5 BIG-IP Link Controller 13.0 F5 BIG-IP Link Controller 12.1.2 HF1 F5 BIG-IP Link Controller 11.6.1 HF2 F5 BIG-IP Link Controller 11.5.4 HF3 F5 BIG-IP GTM 11.5.4 HF3 F5 BIG-IP DNS 13.0 F5 BIG-IP DNS 12.1.2 HF1 F5 BIG-IP ASM 13.0 F5 BIG-IP ASM 12.1.2 HF1 F5 BIG-IP ASM 11.6.1 HF2 F5 BIG-IP ASM 11.5.4 HF3 F5 BIG-IP APM 13.0 F5 BIG-IP APM 12.1.2 HF1 F5 BIG-IP APM 11.6.1 HF2 F5 BIG-IP APM 11.5.4 HF3 F5 BIG-IP Analytics 13.0 F5 BIG-IP Analytics 12.1.2 HF1 F5 BIG-IP Analytics 11.6.1 HF2 F5 BIG-IP Analytics 11.5.4 HF3 F5 BIG-IP AFM 13.0 F5 BIG-IP AFM 12.1.2 HF1 F5 BIG-IP AFM 11.6.1 HF2 F5 BIG-IP AFM 11.5.4 HF3 F5 BIG-IP AAM 13.0 F5 BIG-IP AAM 12.1.2 HF1 F5 BIG-IP AAM 11.6.1 HF2 F5 BIG-IP AAM 11.5.4 HF3

Discussion

Multiple F5 BIG-IP Products CVE-2016-9250 Security Bypass Vulnerability

Multiple F5 BIG-IP Products are prone to a security-bypass vulnerability.

Successfully exploiting this issue may allow attackers to perform unauthorized actions. This may lead to other attacks.

Exploit / POC

Multiple F5 BIG-IP Products CVE-2016-9250 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Multiple F5 BIG-IP Products CVE-2016-9250 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

References

Multiple F5 BIG-IP Products CVE-2016-9250 Security Bypass Vulnerability

References: