CVE-2017-6168 : Security Advisory and Response

CVE-2017-6168 was published on November 17, 2017, by F5. The vulnerability affects BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2 HF1, and 13.0.0-13.0.0 HF2, potentially exposing servers to an Adaptive Chosen Ciphertext attack.

Understanding CVE-2017-6168

This CVE identifies a vulnerability in virtual servers configured with a Client SSL profile on specific BIG-IP versions, making them susceptible to a significant security risk.

What is CVE-2017-6168?

The vulnerability in CVE-2017-6168 allows for an Adaptive Chosen Ciphertext attack, commonly known as the Bleichenbacher attack. This exploit could lead to the recovery of plaintext from encrypted messages and potential Man-in-the-middle attacks.

The Impact of CVE-2017-6168

The vulnerability poses a severe risk as attackers can potentially decrypt encrypted messages and execute Man-in-the-middle attacks without needing access to the server's private key, also known as a ROBOT attack.

Technical Details of CVE-2017-6168

CVE-2017-6168 involves the following technical aspects:

Vulnerability Description

The vulnerability affects virtual servers with a Client SSL profile on specific BIG-IP versions, making them vulnerable to an Adaptive Chosen Ciphertext attack.

Affected Systems and Versions

BIG-IP versions 11.6.0-11.6.2
BIG-IP versions 12.0.0-12.1.2 HF1
BIG-IP versions 13.0.0-13.0.0 HF2

Exploitation Mechanism

The vulnerability can be exploited to perform a Bleichenbacher attack, potentially leading to plaintext recovery from encrypted messages and Man-in-the-middle attacks.

Mitigation and Prevention

To address CVE-2017-6168, consider the following steps:

Immediate Steps to Take

Apply the necessary security patches provided by F5 for the affected BIG-IP versions.
Monitor network traffic for any suspicious activities that may indicate exploitation of the vulnerability.

Long-Term Security Practices

Regularly update and patch all software and firmware to prevent vulnerabilities.
Implement strong encryption protocols and secure configurations to enhance server security.

Patching and Updates

Install the recommended patches for BIG-IP versions 11.6.2 HF1, 12.1.2 HF2, and 13.0.0 HF3 to mitigate the vulnerability.