Attackers can target various F5 BIG-IP appliances. After successful attacks, access to passwords is conceivable in addition to unauthorized access. Safeguarded versions are available.
Advertisement
Admins should study the alerts linked below this message to locate the products and security updates that affect them.
The vulnerabilities
The vulnerabilities affect, among other things, the Edge Client under macOS and Windows in the context of BIG-IP Access Policy Manager (APM). By successfully exploiting a vulnerability (CVE-2023-36858 “high”), an authenticated attacker can modify the server list and thus redirect traffic.
The Configuration Utility is vulnerable in all BIG-IP modules. Attackers can attack the vulnerability (CVE-2023-38138 “high”) with prepared URLs for an XSS attack, which is not persistent.
Weak Passwords
The remaining vulnerabilities are classified as “medium” threat level. Here it is possible, among other things, for attackers to attack BIG-IP platforms with Cavium Nitrox FIPS HSM cards (CVE-2023-3470 “medium”). This constellation generates deterministic passwords that authenticated attackers with access to the TMOS shell can reconstruct. It is also possible that attackers with at least guest rights can paralyze the iCOntrol SOAP process.
Advertisement
List sorted by threat level in descending order:
(of the)
Go to home page
#Security #updates #BIGIP #Attackers #guess #passwords
/cloudfront-eu-central-1.images.arcpublishing.com/prisa/W4SHIGHNBRBQRI2L5AXQV2PYAM.jpg "The PNV rejects the PP's request to reconsider its veto of Vox to support the investiture of Feijóo 7")
