製品・ソフトウェアに関する情報

JVN脆弱性詳細

F5 BIG-IP システムのバーチャルサーバにおけるシステム設定を変更される脆弱性

Title	F5 BIG-IP システムのバーチャルサーバにおけるシステム設定を変更される脆弱性
Summary	F5 BIG-IP システムのバーチャルサーバには、HTTP Explicit Proxy 機能、または SOCKS プロファイルが設定されている場合、システム設定を変更される、システムファイルを読まれる、および任意のコードを実行される脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-284: Improper Access Control (不適切なアクセス制御) と識別されています。 http://cwe.mitre.org/data/definitions/284.html
Possible impacts	第三者により、システム設定を変更される、システムファイルを読まれる、および任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 28, 2016, midnight
Registration Date	Oct. 6, 2016, 12:23 p.m.
Last Update	Oct. 6, 2016, 12:23 p.m.

CVSS3.0 : 緊急
Score	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

F5 Networks

BIG-IP Access Policy Manager (APM) 11.5.0 から 11.5.1 HF10

BIG-IP Access Policy Manager (APM) 11.5.2 から 11.5.4 HF1

BIG-IP Access Policy Manager (APM) 11.6.0 から 11.6.0 HF7

BIG-IP Access Policy Manager (APM) 11.6.1

BIG-IP Access Policy Manager (APM) 12.0.0 から 12.0.0 HF3

BIG-IP Access Policy Manager (APM) 12.1.0 から 12.1.0 HF1

BIG-IP Advanced Firewall Manager (AFM) 11.5.0 から 11.5.1 HF10

BIG-IP Advanced Firewall Manager (AFM) 11.5.2 から 11.5.4 HF1

BIG-IP Advanced Firewall Manager (AFM) 11.6.0 から 11.6.0 HF7

BIG-IP Advanced Firewall Manager (AFM) 11.6.1

BIG-IP Advanced Firewall Manager (AFM) 12.0.0 から 12.0.0 HF3

BIG-IP Advanced Firewall Manager (AFM) 12.1.0 から 12.1.0 HF1

BIG-IP Application Acceleration Manager (AAM) 11.5.0 から 11.5.1 HF10

BIG-IP Application Acceleration Manager (AAM) 11.5.2 から 11.5.4 HF1

BIG-IP Application Acceleration Manager (AAM) 11.6.0 から 11.6.0 HF7

BIG-IP Application Acceleration Manager (AAM) 11.6.1

BIG-IP Application Acceleration Manager (AAM) 12.0.0 から 12.0.0 HF3

BIG-IP Application Acceleration Manager (AAM) 12.1.0 から 12.1.0 HF1

BIG-IP Application Security Manager (ASM) 11.5.0 から 11.5.1 HF10

BIG-IP Application Security Manager (ASM) 11.5.2 から 11.5.4 HF1

BIG-IP Application Security Manager (ASM) 11.6.0 から 11.6.0 HF7

BIG-IP Application Security Manager (ASM) 11.6.1

BIG-IP Application Security Manager (ASM) 12.0.0 から 12.0.0 HF3

BIG-IP Application Security Manager (ASM) 12.1.0 から 12.1.0 HF1

BIG-IP Link Controller 11.5.0 から 11.5.1 HF10

BIG-IP Link Controller 11.5.2 から 11.5.4 HF1

BIG-IP Link Controller 11.6.0 から 11.6.0 HF7

BIG-IP Link Controller 11.6.1

BIG-IP Link Controller 12.0.0 から 12.0.0 HF3

BIG-IP Link Controller 12.1.0 から 12.1.0 HF1

BIG-IP Local Traffic Manager (LTM) 11.5.0 から 11.5.1 HF10

BIG-IP Local Traffic Manager (LTM) 11.5.2 から 11.5.4 HF1

BIG-IP Local Traffic Manager (LTM) 11.6.0 から 11.6.0 HF7

BIG-IP Local Traffic Manager (LTM) 11.6.1

BIG-IP Local Traffic Manager (LTM) 12.0.0 から 12.0.0 HF3

BIG-IP Local Traffic Manager (LTM) 12.1.0 から 12.1.0 HF1

BIG-IP Policy Enforcement Manager (PEM) 11.5.0 から 11.5.1 HF10

BIG-IP Policy Enforcement Manager (PEM) 11.5.2 から 11.5.4 HF1

BIG-IP Policy Enforcement Manager (PEM) 11.6.0 から 11.6.0 HF7

BIG-IP Policy Enforcement Manager (PEM) 11.6.1

BIG-IP Policy Enforcement Manager (PEM) 12.0.0 から 12.0.0 HF3

BIG-IP Policy Enforcement Manager (PEM) 12.1.0 から 12.1.0 HF1

BIG-IP WebSafe 11.6.0 から 11.6.0 HF7

BIG-IP WebSafe 11.6.1

BIG-IP WebSafe 12.0.0 から 12.0.0 HF3

BIG-IP WebSafe 12.1.0 から 12.1.0 HF1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-5700	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5700
National Vulnerability Database (NVD)
2	CVE-2016-5700	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5700

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Security Advisory
1	SOL35520031: BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700	https://support.f5.com/kb/en-us/solutions/public/k/35/sol35520031.html

Change Log

No	Changed Details	Date of change
0	[2016年10月06日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-5700

Summary	Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with the HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers to modify the system configuration, read system files, and possibly execute arbitrary code via unspecified vectors.
Publication Date	Oct. 4, 2016, 1:09 a.m.
Registration Date	Jan. 26, 2021, 2:14 p.m.
Last Update	Nov. 21, 2024, 11:54 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_websafe:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_websafe:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_websafe:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_websafe:12.0.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_link_controller:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_link_controller:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_link_controller:12.0.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:::::::*

Configuration7	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.3:::::::*

Configuration8	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/93325
2	http://www.securityfocus.com/bid/93325
3	http://www.securitytracker.com/id/1036928	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1036928	Third Party Advisory VDB Entry
5	https://support.f5.com/kb/en-us/solutions/public/k/35/sol35520031.html	Vendor Advisory
6	https://support.f5.com/kb/en-us/solutions/public/k/35/sol35520031.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-284	不適切なアクセス制御	https://cwe.mitre.org/data/definitions/284.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_link_controller:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_link_controller:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_link_controller:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_link_controller:12.0.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:::::::*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.4:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:::::::*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:::::::*