This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor f5 First view 2018-07-06
Product Big-Ip Domain Name System Last view 2023-10-26
Version 14.1.2.1.0.46.4-eng_hotfix Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:f5:big-ip_domain_name_system

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
8.8 2023-10-26 CVE-2023-46748

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which

may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.

┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

9.8 2023-10-26 CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

4.4 2023-10-10 CVE-2023-45219

Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.┬ ┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

8.7 2023-10-10 CVE-2023-43746

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.┬ A successful exploit can allow the attacker to cross a security boundary.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.8 2023-10-10 CVE-2023-43611

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.┬ This vulnerability is due to an incomplete fix for CVE-2023-38418.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

5.5 2023-10-10 CVE-2023-43485

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.2 2023-10-10 CVE-2023-42768

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.5 2023-10-10 CVE-2023-41964

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

9.9 2023-10-10 CVE-2023-41373

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

5.5 2023-10-10 CVE-2023-41253

When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-41085

When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-40542

When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

8.1 2023-10-10 CVE-2023-40537

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-40534

When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

5.4 2023-08-02 CVE-2023-38423

A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

4.3 2023-08-02 CVE-2023-38419

An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1 2023-08-02 CVE-2023-38138

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1 2023-08-02 CVE-2023-3470

Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. ┬ The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. ┬ On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.

The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.

The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-05-03 CVE-2023-29163

When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

8.8 2023-05-03 CVE-2023-28742

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

4.3 2023-05-03 CVE-2023-28406

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1 2023-05-03 CVE-2023-27378

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-02-01 CVE-2023-23555

On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-02-01 CVE-2023-22842

On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE : Common Weakness Enumeration

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
%idName
12% (18) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
9% (13) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
7% (10) CWE-476 NULL Pointer Dereference
4% (6) CWE-401 Failure to Release Memory Before Removing Last Reference ('Memory L...
4% (6) CWE-269 Improper Privilege Management
4% (6) CWE-20 Improper Input Validation
3% (5) CWE-319 Cleartext Transmission of Sensitive Information
2% (4) CWE-404 Improper Resource Shutdown or Release
2% (4) CWE-352 Cross-Site Request Forgery (CSRF)
2% (4) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...
2% (3) CWE-770 Allocation of Resources Without Limits or Throttling
2% (3) CWE-613 Insufficient Session Expiration
2% (3) CWE-326 Inadequate Encryption Strength
2% (3) CWE-287 Improper Authentication
2% (3) CWE-125 Out-of-bounds Read
2% (3) CWE-78 Improper Sanitization of Special Elements used in an OS Command ('O...
1% (2) CWE-787 Out-of-bounds Write
1% (2) CWE-755 Improper Handling of Exceptional Conditions
1% (2) CWE-682 Incorrect Calculation
1% (2) CWE-668 Exposure of Resource to Wrong Sphere
1% (2) CWE-532 Information Leak Through Log Files
1% (2) CWE-434 Unrestricted Upload of File with Dangerous Type
1% (2) CWE-362 Race Condition
1% (2) CWE-312 Cleartext Storage of Sensitive Information
1% (2) CWE-306 Missing Authentication for Critical Function

SAINT Exploits

Description Link
F5 BIG-IP iControl REST vulnerability More info here

Snort® IPS/IDS

Date Description
2020-08-11 F5 BIG-IP Traffic Management User Interface remote code execution attempt
RuleID : 54484 - Type : SERVER-WEBAPP - Revision : 2
2020-08-06 F5 BIG-IP Traffic Management User Interface remote code execution attempt
RuleID : 54462 - Type : SERVER-WEBAPP - Revision : 3
2020-07-07 lodash defaultsDeep prototype pollution attempt
RuleID : 54184 - Type : SERVER-OTHER - Revision : 1

Nessus® Vulnerability Scanner

id Description
2019-01-11 Name: The remote Virtuozzo host is missing multiple security updates.
File: Virtuozzo_VZA-2018-075.nasl - Type: ACT_GATHER_INFO
2019-01-10 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa10917_184R1.nasl - Type: ACT_GATHER_INFO
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-50075276e8.nasl - Type: ACT_GATHER_INFO
2018-12-11 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2018-1406.nasl - Type: ACT_GATHER_INFO
2018-11-16 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2018-3083.nasl - Type: ACT_GATHER_INFO
2018-10-26 Name: The remote EulerOS Virtualization host is missing a security update.
File: EulerOS_SA-2018-1352.nasl - Type: ACT_GATHER_INFO
2018-10-10 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2018-2846.nasl - Type: ACT_GATHER_INFO
2018-09-04 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2018-1278.nasl - Type: ACT_GATHER_INFO
2018-09-04 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2018-1279.nasl - Type: ACT_GATHER_INFO
2018-08-16 Name: The remote Debian host is missing a security update.
File: debian_DLA-1466.nasl - Type: ACT_GATHER_INFO
2018-08-15 Name: The remote Amazon Linux 2 host is missing a security update.
File: al2_ALAS-2018-1058.nasl - Type: ACT_GATHER_INFO
2018-08-15 Name: The remote Amazon Linux AMI host is missing a security update.
File: ala_ALAS-2018-1058.nasl - Type: ACT_GATHER_INFO
2018-08-15 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4272.nasl - Type: ACT_GATHER_INFO
2018-08-07 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4266.nasl - Type: ACT_GATHER_INFO
2018-08-03 Name: The remote Virtuozzo host is missing a security update.
File: Virtuozzo_VZA-2018-049.nasl - Type: ACT_GATHER_INFO
2018-07-24 Name: The remote Fedora host is missing a security update.
File: fedora_2018-8484550fff.nasl - Type: ACT_GATHER_INFO