製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の F5 製品の iControl REST サービスにおける重要な情報を取得される脆弱性

Title	複数の F5 製品の iControl REST サービスにおける重要な情報を取得される脆弱性
Summary	複数の F5 製品の iControl REST サービスには、重要な情報を取得される脆弱性が存在します。
Possible impacts	リモート認証された管理者により、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 9, 2016, midnight
Registration Date	June 29, 2016, 11:57 a.m.
Last Update	June 29, 2016, 11:57 a.m.

CVSS3.0 : 警告
Score	4.9
Vector	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS2.0 : 警告
Score	4
Vector	AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected System

F5 Networks

BIG-IP Access Policy Manager (APM) 11.5.0 から 11.5.3

BIG-IP Access Policy Manager (APM) 11.6.0

BIG-IP Access Policy Manager (APM) 12.0.0 から 12.0.0 HF2

BIG-IP Advanced Firewall Manager (AFM) 11.5.0 から 11.5.3

BIG-IP Advanced Firewall Manager (AFM) 11.6.0

BIG-IP Advanced Firewall Manager (AFM) 12.0.0 から 12.0.0 HF2

BIG-IP Analytics 11.5.0 から 11.5.3

BIG-IP Analytics 11.6.0

BIG-IP Analytics 12.0.0 から 12.0.0 HF2

BIG-IP Application Acceleration Manager (AAM) 11.5.0 から 11.5.3

BIG-IP Application Acceleration Manager (AAM) 11.6.0

BIG-IP Application Acceleration Manager (AAM) 12.0.0 から 12.0.0 HF2

BIG-IP Application Security Manager (ASM) 11.5.0 から 11.5.3

BIG-IP Application Security Manager (ASM) 11.6.0

BIG-IP Application Security Manager (ASM) 12.0.0 から 12.0.0 HF2

BIG-IP Domain Name System (DNS) 12.0.0 から 12.0.0 HF2

BIG-IP Global Traffic Manager (GTM) 11.5.0 から 11.5.3

BIG-IP Global Traffic Manager (GTM) 11.6.0

BIG-IP Link Controller 11.5.0 から 11.5.3

BIG-IP Link Controller 11.6.0

BIG-IP Link Controller 12.0.0 から 12.0.0 HF2

BIG-IP Local Traffic Manager (LTM) 11.5.0 から 11.5.3

BIG-IP Local Traffic Manager (LTM) 11.6.0

BIG-IP Local Traffic Manager (LTM) 12.0.0 から 12.0.0 HF2

BIG-IP Policy Enforcement Manager (PEM) 11.5.0 から 11.5.3

BIG-IP Policy Enforcement Manager (PEM) 11.6.0

BIG-IP Policy Enforcement Manager (PEM) 12.0.0 から 12.0.0 HF2

BIG-IQ Application Delivery Controller (ADC) 4.5.0

BIG-IQ Centralized Management 4.6.0

BIG-IQ Cloud 4.0.0 から 4.5.0

BIG-IQ Cloud and Orchestration 1.0.0

BIG-IQ Device 4.2.0 から 4.5.0

BIG-IQ Security 4.0.0 から 4.5.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-5021	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5021
National Vulnerability Database (NVD)
2	CVE-2016-5021	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5021

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Security Advisory
1	sol99998454: iControl REST vulnerability CVE-2016-5021	https://support.f5.com/kb/en-us/solutions/public/k/99/sol99998454/

Change Log

No	Changed Details	Date of change
0	[2016年06月29日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-5021

Summary	The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF3; BIG-IP DNS 12.x before 12.0.0 HF3; BIG-IP GTM 11.5.x before 11.5.4 and 11.6.x before 11.6.1; BIG-IQ Cloud and Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 allows remote authenticated administrators to obtain sensitive information via unspecified vectors.
Publication Date	June 25, 2016, 2:59 a.m.
Registration Date	Jan. 26, 2021, 2:13 p.m.
Last Update	Nov. 21, 2024, 11:53 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_application_delivery_controller:4.5.0:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_cloud_and_orchestration:1.0.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.3:::::::*

Configuration7	or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_security:4.3.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.4.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.1.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.2.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.0.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.5.0:::::::*

Configuration8	or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_cloud:4.2.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.3.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.4.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.1.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.5.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.0.0:::::::*

Configuration9	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.2:::::::*

Configuration10		or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_centralized_management:4.6.0:::::::*

Configuration11		or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_domain_name_system:12.0.0:::::::*

Configuration12	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_analytics:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_analytics:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_analytics:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_analytics:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_analytics:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_analytics:11.5.0:::::::*

Configuration13	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_link_controller:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:12.0.0:::::::*

Configuration14	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:::::::*

Configuration15	or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_device:4.2.0:::::::*
cpe:2.3:a:f5:big-iq_device:4.5.0:::::::*
cpe:2.3:a:f5:big-iq_device:4.4.0:::::::*
cpe:2.3:a:f5:big-iq_device:4.3.0:::::::*

Configuration16	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securitytracker.com/id/1036172	Third Party Advisory VDB Entry
2	http://www.securitytracker.com/id/1036172	Third Party Advisory VDB Entry
3	https://support.f5.com/kb/en-us/solutions/public/k/99/sol99998454/	Vendor Advisory
4	https://support.f5.com/kb/en-us/solutions/public/k/99/sol99998454/	Vendor Advisory

Common Vulnerabilities List

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:::::::*

Configuration7	or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_security:4.3.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.4.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.1.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.2.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.0.0:::::::*
cpe:2.3:a:f5:big-iq_security:4.5.0:::::::*

Configuration8	or higher	or less	more than	less than
cpe:2.3:a:f5:big-iq_cloud:4.2.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.3.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.4.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.1.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.5.0:::::::*
cpe:2.3:a:f5:big-iq_cloud:4.0.0:::::::*