SB2021021905 - Denial of service in curl implementation for Command Line Interface, EAV Monitors, iRules components in F5 BIG-IP products

Description

This security bulletin contains information about 1 security vulnerability.

1) Uncontrolled Recursion (CVE-ID: CVE-2020-8285)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due tu uncontrolled recursion when processing FTP responses within the wildcard matching functionality, which allows a callback (set with <a href="https://curl.se/libcurl/c/CURLOPT_CHUNK_BGN_FUNCTION.html">CURLOPT_CHUNK_BGN_FUNCTION</a>) to return information back to libcurl on how to handle a specific entry in a directory when libcurl iterates over a list of all available entries. A remote attacker who controls the malicious FTP server can trick the victim to connect to it and crash the application, which is using the affected libcurl version.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://support.f5.com/csp/article/K61186963