CVE-2016-9245: Medium severity riverbed steelapp traffic manager vulnerability

Published Mar 7, 2017

Updated

In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "Normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.

Affected Software

30 affected components

F5 Big-ip Local Traffic Manager=12.1.0

F5 Big-ip Local Traffic Manager=12.1.1

F5 Big-ip Local Traffic Manager=12.1.2

F5 Big-ip Application Acceleration Manager=12.1.0

F5 Big-ip Application Acceleration Manager=12.1.1

F5 Big-ip Application Acceleration Manager=12.1.2

F5 BIG-IP Advanced Firewall Manager=12.1.0

F5 BIG-IP Advanced Firewall Manager=12.1.1

F5 BIG-IP Advanced Firewall Manager=12.1.2

F5 BIG-IP Analytics=12.1.0

F5 BIG-IP Analytics=12.1.1

F5 BIG-IP Analytics=12.1.2

F5 BIG-IP Access Policy Manager=12.1.0

F5 BIG-IP Access Policy Manager=12.1.1

F5 BIG-IP Access Policy Manager=12.1.2

F5 BIG-IP Application Security Manager=12.1.0

F5 BIG-IP Application Security Manager=12.1.1

F5 BIG-IP Application Security Manager=12.1.2

F5 Big-ip Domain Name System=12.1.0

F5 Big-ip Domain Name System=12.1.1

F5 Big-ip Domain Name System=12.1.2

F5 Big-ip Link Controller=12.1.0

F5 Big-ip Link Controller=12.1.1

F5 Big-ip Link Controller=12.1.2

F5 Big-ip Policy Enforcement Manager=12.1.0

F5 Big-ip Policy Enforcement Manager=12.1.1

F5 Big-ip Policy Enforcement Manager=12.1.2

F5 Big-ip Websafe=12.1.0

F5 Big-ip Websafe=12.1.1

F5 Big-ip Websafe=12.1.2

Event History

Mar 7, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9245?

The severity of CVE-2016-9245 is considered high due to its potential to cause the Traffic Management Microkernel (TMM) to restart.

How do I fix CVE-2016-9245?

To fix CVE-2016-9245, upgrade your F5 BIG-IP systems to version 12.1.3 or later.

What types of servers are affected by CVE-2016-9245?

CVE-2016-9245 affects virtual servers with an HTTP profile on F5 BIG-IP systems.

Which F5 BIG-IP versions are vulnerable to CVE-2016-9245?

F5 BIG-IP versions 12.1.0, 12.1.1, and 12.1.2 are vulnerable to CVE-2016-9245.

What impact does CVE-2016-9245 have on system performance?

CVE-2016-9245 can lead to system downtime as the TMM restarts when exposed to malicious requests.