F5 issues fixes for major cybersecurity flaw
F5 has patched its BIG-IP application to address two critical vulnerabilities
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
F5has issued patches for its BIG-IP application delivery controllers after a security researcher discovered two critical vulnerabilities in its software.
The vulnerabilities, tracked asCVE-2020-5902andCVE-2020-5903, reside in a configuration tool known as the Traffic Management User Interface and exploiting them could allow an attacker to gain full admin control over a vulnerable device.
The first vulnerability has a CVSS score of 10 out of 10 and puts F5’s networking equipment at risk of arbitrary code execution while the second one has a CVSS score of 7.5 and is a JavaScript-based cross-site scripting (XSS) vulnerability.
What makes these flaws particularly concerning is due to the fact that many large enterprises use BIG-IP gear to handle sending traffic to and from their critical applications. An attack that successfully exploited these vulnerabilities could potentially be disastrous for the many of the Fortune 500 companies that are customers of F5.
BIG-IP application delivery controller
The flaws themselves were first discovered by senior web application security researcher Mikhail Klyuchnikov atPositive Technologieswho provided further insight on them in ablog post, saying:
“By exploiting this vulnerability, a remote attacker with access to the BIG-IP configuration utility could, without authorization, perform remote code execution. The attacker can create or delete files, disable services, intercept information, run arbitrary system commands and Java code, completely compromise the system, and pursue further targets, such as the internal network. RCE in this case results from security flaws in multiple components, such as one that allows directory traversal exploitation. This is particularly dangerous for companies whose F5 BIG-IP web interface is listed on search engines such as Shodan. Fortunately, most companies using the product do not enable access to the interface from the internet."
Network admins are advised to update their firmware as soon as possible to avoid falling victim to any potential attacks leveraging the two vulnerabilities.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The flaws are present in BIG-IP versions 11 through 15 and those using the company’s networking equipment can find more details on how to patch them in thissecurity bulletinas well asthis onefrom F5 Networks.
ViaThe Register
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Washington state court systems taken offline following cyberattack
Is it still worth using Proton VPN Free?
Top 3 things you have to try with the new ChatGPT search
