CVE-2017-6169 : Exploit Details and Defense Strategies

If you are using version 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2 of F5 BIG-IP virtual server and have enabled the URL categorization feature, there is a possibility that the Traffic Management Microkernel (TMM) might generate a core file in the event of receiving malformed URLs during the categorization process.

Understanding CVE-2017-6169

This CVE affects F5 Networks, Inc.'s BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3, and 11.6.0-11.6.2.

What is CVE-2017-6169?

CVE-2017-6169 is a vulnerability in F5 BIG-IP virtual servers that can lead to a Denial of Service (DoS) condition when the URL categorization feature is enabled.

The Impact of CVE-2017-6169

The vulnerability can cause the Traffic Management Microkernel (TMM) to generate a core file upon encountering malformed URLs during the categorization process, potentially disrupting services.

Technical Details of CVE-2017-6169

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The issue arises in versions 13.0.0, 12.0.0-12.1.3, and 11.6.0-11.6.2 of F5 BIG-IP PEM when the URL categorization feature is active, triggering TMM to create a core file due to malformed URLs.

Affected Systems and Versions

Product: BIG-IP PEM
Vendor: F5 Networks, Inc.
Affected Versions: 13.0.0, 12.0.0-12.1.3, 11.6.0-11.6.2

Exploitation Mechanism

The vulnerability is exploited by sending malformed URLs to a BIG-IP virtual server with the URL categorization feature enabled, causing TMM to crash and generate a core file.

Mitigation and Prevention

Protect your systems from CVE-2017-6169 with the following steps:

Immediate Steps to Take

Disable the URL categorization feature if not essential.
Monitor system logs for any TMM core file generation.

Long-Term Security Practices

Regularly update F5 BIG-IP PEM to the latest version.
Implement network security measures to filter out potentially malicious traffic.

Patching and Updates

Apply patches provided by F5 Networks, Inc. to address the vulnerability and prevent TMM core file generation.