CVE-2016-9251: High severity riverbed steelapp traffic manager vulnerability
Published May 9, 2017
·Updated
In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection.
Affected Software
40 affected components
F5 Big-ip Local Traffic Manager=12.0.0
F5 Big-ip Local Traffic Manager=12.1.0
F5 Big-ip Local Traffic Manager=12.1.1
F5 Big-ip Local Traffic Manager=12.1.2
F5 Big-ip Application Acceleration Manager=12.0.0
F5 Big-ip Application Acceleration Manager=12.1.0
F5 Big-ip Application Acceleration Manager=12.1.1
F5 Big-ip Application Acceleration Manager=12.1.2
F5 BIG-IP Advanced Firewall Manager=12.0.0
F5 BIG-IP Advanced Firewall Manager=12.1.0
F5 BIG-IP Advanced Firewall Manager=12.1.1
F5 BIG-IP Advanced Firewall Manager=12.1.2
F5 BIG-IP Analytics=12.0.0
F5 BIG-IP Analytics=12.1.0
F5 BIG-IP Analytics=12.1.1
F5 BIG-IP Analytics=12.1.2
F5 BIG-IP Access Policy Manager=12.0.0
F5 BIG-IP Access Policy Manager=12.1.0
F5 BIG-IP Access Policy Manager=12.1.1
F5 BIG-IP Access Policy Manager=12.1.2
F5 BIG-IP Application Security Manager=12.0.0
F5 BIG-IP Application Security Manager=12.1.0
F5 BIG-IP Application Security Manager=12.1.1
F5 BIG-IP Application Security Manager=12.1.2
F5 Big-ip Domain Name System=12.0.0
F5 Big-ip Domain Name System=12.1.0
F5 Big-ip Domain Name System=12.1.1
F5 Big-ip Domain Name System=12.1.2
F5 Big-ip Link Controller=12.0.0
F5 Big-ip Link Controller=12.1.0
F5 Big-ip Link Controller=12.1.1
F5 Big-ip Link Controller=12.1.2
F5 Big-ip Policy Enforcement Manager=12.0.0
F5 Big-ip Policy Enforcement Manager=12.1.0
F5 Big-ip Policy Enforcement Manager=12.1.1
F5 Big-ip Policy Enforcement Manager=12.1.2
F5 Big-ip Websafe=12.0.0
F5 Big-ip Websafe=12.1.0
F5 Big-ip Websafe=12.1.1
F5 Big-ip Websafe=12.1.2
Event History
May 9, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2016-9251?
CVE-2016-9251 is classified as a high severity vulnerability due to the potential for privilege escalation.
2
How do I fix CVE-2016-9251?
To fix CVE-2016-9251, update your F5 BIG-IP software to a version later than 12.1.2.
3
What versions of F5 BIG-IP are affected by CVE-2016-9251?
CVE-2016-9251 affects F5 BIG-IP versions 12.0.0 through 12.1.2.
4
What types of attacks are possible due to CVE-2016-9251?
CVE-2016-9251 allows an authenticated attacker to escalate privileges through a crafted iControl REST connection.
5
Is authentication required to exploit CVE-2016-9251?
Yes, exploitation of CVE-2016-9251 requires that the attacker is authenticated.