F5-K000140961: High severity f5 big-ip and big-iq centralized management vulnerability
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of F5-K000140961?
The severity of F5-K000140961 is classified as a medium-risk vulnerability.
How do I fix F5-K000140961?
To fix F5-K000140961, upgrade to the latest versions of the affected F5 products as specified in the advisory.
What products are affected by F5-K000140961?
Affected products include F5 BIG-IP versions 15.1.0 to 15.1.10, 16.1.0 to 16.1.5, 17.1.0 to 17.1.1, F5 BIG-IQ Centralized Management versions 8.2.0 to 8.3.0, and F5 Traffix Systems Signaling Delivery Controller version 5.2.0.
What kind of attack does F5-K000140961 expose systems to?
F5-K000140961 exposes systems to potential unauthorized changes of access control list (ACL) through malicious archive extraction.
Who can exploit the F5-K000140961 vulnerability?
A local attacker can exploit the F5-K000140961 vulnerability by providing a malicious archive to the victim user.