CVE-2017-6141 Explained : Impact and Mitigation

CVE-2017-6141 was published on July 12, 2017, by F5 Networks, Inc. The vulnerability affects F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe versions 12.1.0 through 12.1.2, potentially leading to service disruption.

Understanding CVE-2017-6141

This CVE identifies a TLS abbreviated handshake vulnerability in specific F5 products, impacting the Traffic Management Microkernel (TMM) under certain conditions.

What is CVE-2017-6141?

The vulnerability in F5 products can disrupt the TMM when a client SSL profile with the Session Ticket option enabled is used. Notably, the Session Ticket option is disabled by default.

The Impact of CVE-2017-6141

The vulnerability poses a risk of service disruption in affected F5 products, potentially affecting the availability and performance of the Traffic Management Microkernel.

Technical Details of CVE-2017-6141

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe versions 12.1.0 through 12.1.2, specific values in a TLS abbreviated handshake can disrupt the TMM when using a client SSL profile with the Session Ticket option enabled.

Affected Systems and Versions

Affected Systems: F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebSafe
Affected Versions: 12.1.0 through 12.1.2

Exploitation Mechanism

The vulnerability is triggered when a client SSL profile with the Session Ticket option enabled is utilized, potentially leading to TMM service disruption.

Mitigation and Prevention

To address CVE-2017-6141, consider the following mitigation strategies:

Immediate Steps to Take

Disable the Session Ticket option in client SSL profiles if not required.
Monitor F5 Networks for security advisories and updates.

Long-Term Security Practices

Regularly update and patch F5 products to mitigate known vulnerabilities.
Implement network segmentation and access controls to limit exposure to potential threats.

Patching and Updates

Stay informed about security updates and patches released by F5 Networks to address CVE-2017-6141 and other vulnerabilities.