#VU8987 Improper input validation in F5 Networks products - CVE-2017-6162

Vulnerability identifier: #VU8987

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2017-6162

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
BIG-IP PSM
BIG-IP PEM
BIG-IP GTM
BIG-IP ASM
BIG-IP APM
BIG-IP Analytics
BIG-IP AFM
BIG-IP LTM
BIG-IP WebAccelerator
BIG-IP Edge Gateway
BIG-IP DNS
BIG-IP Link Controller
BIG-IP AAM
BIG-IP WebSafe

Software vendor:
F5 Networks

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in virtual servers configured with a TCP profile due to improper input validation. A remote attacker can send specially crafted TCP traffic to cause the target Traffic Management Microkernel (TMM) to restart.

Successful exploitation of the vulnerability results in denial of service.

Install update from vendor's website.

• https://support.f5.com/csp/article/K13421245