Skip to content
OpenAdvisories
High WID-SEC-2023-0265 16 CVEs

F5 BIG-IP: Mehrere Schwachstellen

Published Feb 1, 2023 · Updated Jun 28, 2023 · Revision 2 · de-DE

Vendor: F5 Product: BIG-IP Product: BIG-IP < 14.1.5.3 Product: BIG-IP < 15.1.8.1 Product: BIG-IP < 16.1.3.3 Product: BIG-IP < 17.0.0.2 Product: BIG-IP < 17.1.0

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um seine Privilegien zu erhöhen, Code zur Ausführung zu bringen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen und einen Denial of Service zu verursachen.

Product

F5 FirePass ist ein SSL-VPN Gateway der F5 Corporation. Die BIG-IP ist eine Netzwerk Appliance auf der die meisten F5 Produkte laufen.

Vulnerabilities 16

  • High 8.5
    CVE-2023-22374 EPSS 71%

    iControl SOAP vulnerability

    A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attac…

    F5 BIG-IP Network devices
  • High 7.8
    CVE-2023-22358

    BIG-IP Edge Client for Windows vulnerability

    In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 APM Clients Network devices
  • High 7.5
    CVE-2023-22281

    BIG-IP AFM vulnerability

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destination NAT rule is configured on a FastL4 virtual server, undisclosed traffic can ca…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22323

    BIG-IP SSL OCSP Authentication profile vulnerability

    In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CP…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22340

    BIG-IP SIP profile vulnerability

    On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause TMM to terminate. Note: Software vers…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22341

    BIG-IP APM OAuth vulnerability

    On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate: * An OAuth Server that references an…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22422

    HTTP profile vulnerability

    On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Tr…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22664

    BIG-IP HTTP/2 profile vulnerability

    On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in me…

    F5 BIG-IP BIG-IP SPK Network devices
  • High 7.5
    CVE-2023-22839

    BIG-IP DNS profile vulnerability

    On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN c…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-22842

    BIG-IP SIP profile vulnerability

    On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel …

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-23552

    BIG-IP Advanced WAF and ASM vulnerability

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an…

    F5 BIG-IP Network devices
  • High 7.5
    CVE-2023-23555

    BIG-IP Virtual Edition vulnerability

    On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undisclosed traffic can …

    F5 BIG-IP BIG-IP SPK Network devices
  • Medium 6.5
    CVE-2023-22283

    BIG-IP Edge Client for Windows vulnerability

    On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the ex…

    F5 APM Clients Network devices
  • Medium 6.1
    CVE-2023-22418

    BIG-IP APM virtual server vulnerability

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows a…

    F5 BIG-IP Network devices
  • Medium 5.9
    CVE-2023-22302

    BIG-IP HTTP profile vulnerability

    In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to t…

    F5 BIG-IP Network devices
  • Medium 4.9
    CVE-2023-22326

    iControl REST and tmsh vulnerability

    In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST…

    F5 BIG-IP BIG-IQ Centralized Management Network devices

Revision history

  1. #2

    Neue Updates von F5 aufgenommen

  2. #1

    Initiale Fassung

References