| Title | 複数の F5 BIG-IP 製品における証明書検証に関する脆弱性 |
|---|---|
| Summary | 複数の F5 BIG-IP 製品には、証明書検証に関する脆弱性が存在します。 |
| Possible impacts | サービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | March 22, 2018, midnight |
| Registration Date | May 24, 2018, 6:23 p.m. |
| Last Update | May 24, 2018, 6:23 p.m. |
| CVSS3.0 : 重要 | |
| Score | 7.5 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS2.0 : 警告 | |
| Score | 5 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| F5 Networks |
| BIG-IP Access Policy Manager (APM) 13.0.0 |
| BIG-IP Access Policy Manager (APM) 13.1.0 |
| BIG-IP Advanced Firewall Manager (AFM) 13.0.0 |
| BIG-IP Advanced Firewall Manager (AFM) 13.1.0 |
| BIG-IP Analytics 13.0.0 |
| BIG-IP Analytics 13.1.0 |
| BIG-IP Application Acceleration Manager (AAM) 13.0.0 |
| BIG-IP Application Acceleration Manager (AAM) 13.1.0 |
| BIG-IP Application Security Manager (ASM) 13.0.0 |
| BIG-IP Application Security Manager (ASM) 13.1.0 |
| BIG-IP Domain Name System (DNS) 13.0.0 |
| BIG-IP Domain Name System (DNS) 13.1.0 |
| BIG-IP Edge Gateway 13.0.0 |
| BIG-IP Edge Gateway 13.1.0 |
| BIG-IP Global Traffic Manager (GTM) 13.0.0 |
| BIG-IP Global Traffic Manager (GTM) 13.1.0 |
| BIG-IP Link Controller 13.0.0 |
| BIG-IP Link Controller 13.1.0 |
| BIG-IP Local Traffic Manager (LTM) 13.0.0 |
| BIG-IP Local Traffic Manager (LTM) 13.1.0 |
| BIG-IP Policy Enforcement Manager (PEM) 13.0.0 |
| BIG-IP Policy Enforcement Manager (PEM) 13.1.0 |
| BIG-IP WebAccelerator 13.0.0 |
| BIG-IP WebAccelerator 13.1.0 |
| BIG-IP WebSafe 13.0.0 |
| BIG-IP WebSafe 13.1.0 |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2018年05月24日] 掲載 |
May 24, 2018, 6:23 p.m. |
| Summary | On F5 BIG-IP versions 13.0.0 - 13.1.0.3, attackers may be able to disrupt services on the BIG-IP system with maliciously crafted client certificate. This vulnerability affects virtual servers associated with Client SSL profile which enables the use of client certificate authentication. Client certificate authentication is not enabled by default in Client SSL profile. There is no control plane exposure. |
|---|---|
| Publication Date | March 23, 2018, 3:29 a.m. |
| Registration Date | March 1, 2021, 7:31 p.m. |
| Last Update | Nov. 21, 2024, 1:08 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:f5:big-ip_websafe:1.0.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* | 13.0.0 | 13.1.0.4 | |||