Author: Melodie Foster
Date: 11th March 2021
F5 Releases Patches for Unauthenticated Remote Code Execution Vulnerability and Other Critical Flaws.
The most severe vulnerability could allow for an unauthenticated attacker to completely compromise systems. Patches for other, unrelated flaws were also released.
The two worst flaws have been given a CVSS score of 9.8 and 9.9 out of 10. One of which allows for an unauthenticated attacker that has network access to the iControl REST interface and be able to create and delete files, disable service and execute arbitrary system commands. F5 has said, “this vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise.”
The other flaw would also allow arbitrary commands to be executed but it requires the attacker to be authenticated and able to access BIG-IP’s Traffic Management User Interface. This vulnerability could also lead to a complete system compromise.
Two other critical buffer overflow bugs have also been patched that were both given a CVSS score of 9.0.
The vulnerabilities affect all BIG-IP and BIG-IQ customers and instances and customers are therefore being urged to update their BIG-IP and BIG-IQ deployments as soon as possible.
Currently, updates do not exist across all software branches. The vulnerabilities have been patched in the following software: BIG-IP versions 126.96.36.199, 188.8.131.52, 14.1.4, 184.108.40.206, 220.127.116.11, and 18.104.22.168. BIG-IQ versions 8.0.0, 22.214.171.124, and 126.96.36.199 .
Cyberfort Colocation Services
Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >
Cyberfort Deep Dives
Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >