CVE-2016-9249: Input Validation

Published Jan 31, 2017

Updated

An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).

Affected Software

30 affected components

F5 Big-ip Local Traffic Manager=12.0.0

F5 Big-ip Local Traffic Manager=12.1.0

F5 Big-ip Local Traffic Manager=12.1.1

F5 Big-ip Application Acceleration Manager=12.0.0

F5 Big-ip Application Acceleration Manager=12.1.0

F5 Big-ip Application Acceleration Manager=12.1.1

F5 BIG-IP Advanced Firewall Manager=12.0.0

F5 BIG-IP Advanced Firewall Manager=12.1.0

F5 BIG-IP Advanced Firewall Manager=12.1.1

F5 BIG-IP Analytics=12.0.0

F5 BIG-IP Analytics=12.1.0

F5 BIG-IP Analytics=12.1.1

F5 BIG-IP Access Policy Manager=12.0.0

F5 BIG-IP Access Policy Manager=12.1.0

F5 BIG-IP Access Policy Manager=12.1.1

F5 BIG-IP Application Security Manager=12.0.0

F5 BIG-IP Application Security Manager=12.1.0

F5 BIG-IP Application Security Manager=12.1.1

F5 Big-ip Domain Name System=12.0.0

F5 Big-ip Domain Name System=12.1.0

F5 Big-ip Domain Name System=12.1.1

F5 Big-ip Link Controller=12.0.0

F5 Big-ip Link Controller=12.1.0

F5 Big-ip Link Controller=12.1.1

F5 Big-ip Policy Enforcement Manager=12.0.0

F5 Big-ip Policy Enforcement Manager=12.1.0

F5 Big-ip Policy Enforcement Manager=12.1.1

F5 Big-ip Websafe=12.0.0

F5 Big-ip Websafe=12.1.0

F5 Big-ip Websafe=12.1.1

Event History

Jan 31, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Data Sourced

via NVD·03:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-9249?

CVE-2016-9249 has a severity rating that indicates it can lead to Denial-of-Service (DoS) if exploited.

How do I fix CVE-2016-9249?

To fix CVE-2016-9249, you should upgrade to the latest version of F5 BIG-IP software that addresses this vulnerability.

What products are affected by CVE-2016-9249?

CVE-2016-9249 affects various versions of F5 BIG-IP Local Traffic Manager, Application Security Manager, and other modules as specified in the vulnerability report.

Can CVE-2016-9249 be exploited remotely?

Yes, CVE-2016-9249 can potentially be exploited remotely through specific traffic patterns targeting the BIG-IP Virtual Server.

What are the potential impacts of CVE-2016-9249?

The potential impact of CVE-2016-9249 includes service disruption due to the Traffic Management Microkernel restarting, resulting in Denial-of-Service.