CVE-2017-6168 On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Client SSL profile may be...
HighCVSS 7.4
EPSS 19.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's private key itself, aka a ROBOT attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip ltm | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip ltm | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip ltm | = 13.0.0 | No fix listed |
| f5 big-ip application acceleration manager | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip application acceleration manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip application acceleration manager | = 13.0.0 | No fix listed |
| f5 big-ip afm | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip afm | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip afm | = 13.0.0 | No fix listed |
| f5 big-ip analytics | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip analytics | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip analytics | = 13.0.0 | No fix listed |
| f5 big-ip apm | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip apm | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip apm | = 13.0.0 | No fix listed |
| f5 big-ip asm | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip asm | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip asm | = 13.0.0 | No fix listed |
| f5 big-ip link controller | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip link controller | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip link controller | = 13.0.0 | No fix listed |
| f5 big-ip pem | >= 11.6.0, <= 11.6.2 | No fix listed |
| f5 big-ip pem | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip pem | = 13.0.0 | No fix listed |
| f5 websafe | >= 12.0.0, <= 12.1.2 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 websafe | = 11.6.2 | No fix listed |
| f5 websafe | = 13.0.0 | No fix listed |
References
- 101901 third-party-advisory vdb-entry
- 1039839 third-party-advisory vdb-entry
- robotattack.org technical-description third-party-advisory
- support.f5.com issue-tracking mitigation vendor-advisory
- VU#144389 third-party-advisory us-government-resource