The network equipment supplier F5 has closed several security gaps in various BIG-IP appliances. None of the gaps are considered critical.

(Image: Artur Szczybylo / Shutterstock.com)

Server admins should study the security warnings from F5 linked below this message in order to locate threatened BIG-IP appliances and to install the available security updates. Otherwise, attackers could cause devices to restart with attacks. This should partly be possible remotely and without authentication.

Application Security Manager, DNS and Local Traffic Manager are affected by the vulnerabilities. The majority of the gaps are classified with the threat level ” medium “. A vulnerability (CVE – 2020 – 5931) is with the threat level ” high “provided.

DoS and XSS attacks Here attackers could attack virtual servers with a OneConnect profile. Due to incorrect processing of HTTP response headers, the Traffic Management Microkernel (TMM) could crash in the course of a DoS attack. The versions 14. 1.2.5 and 15. 1.1 are covered. The version string 16. X is not from the vulnerability affected.

Even more vulnerabilities If attackers target the other gaps, DoS and XSS attacks are conceivable. In the warning messages, admins can find more detailed information on the vulnerabilities and affected and repaired versions.

List sorted in descending order by threat level:

TMM vulnerability CVE – 2020 – 5931 BIG-IP ASM XSS vulnerability CVE – 2020 – 5932 BIG -IP APM SAML SLO vulnerability CVE – 16 – 5934 BIG-IP HTTP compression profile vulnerability CVE – 2020 – 5933 BIG-IP Client SSL Security Advisory CVE – 2020 – 5936 BIG-IP AFM vulnerability CVE – 2020 – 5937 BIG-IP MQTT iRule vulnerability CVE – 2020 – 5935 F5 IPsec vulnerability CVE – 16 – 5938 (of)