CVE-2021-23053 : Security Advisory and Response
Discover the details of CVE-2021-23053 affecting BIG-IP Advanced WAF and BIG-IP ASM versions. Learn about the impacts, technical specifics, and mitigation steps for this vulnerability.
A vulnerability, CVE-2021-23053, affects BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6. When the brute force protection feature is enabled and the virtual server is under attack, it may lead to MySQL database disk space exhaustion.
Understanding CVE-2021-23053
This section provides insights into the nature and impact of CVE-2021-23053.
What is CVE-2021-23053?
The vulnerability occurs in BIG-IP Advanced WAF and BIG-IP ASM when the brute force protection feature is active on a virtual server, potentially causing MySQL database disk space saturation.
The Impact of CVE-2021-23053
The vulnerability could result in a MySQL database running out of disk space due to the absence of row limits on specific tables during brute force attacks.
Technical Details of CVE-2021-23053
Explore the technical aspects and specifics of CVE-2021-23053.
Vulnerability Description
The issue arises in BIG-IP Advanced WAF and BIG-IP ASM versions due to a lack of row limits on undisclosed tables in the MySQL database during brute force attacks.
Affected Systems and Versions
Systems running BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 are vulnerable to this exploit.
Exploitation Mechanism
Attackers can exploit this vulnerability by triggering brute force attacks on virtual servers with the mentioned configurations.
Mitigation and Prevention
Learn how to mitigate and prevent the risks associated with CVE-2021-23053.
Immediate Steps to Take
Disable brute force protection on virtual servers and monitor MySQL database disk space to prevent exhaustion.
Long-Term Security Practices
Regularly update BIG-IP Advanced WAF and BIG-IP ASM to the latest versions and follow security best practices to enhance protection.
Patching and Updates
Ensure timely application of patches released by F5 to address the vulnerability in affected versions of BIG-IP Advanced WAF and BIG-IP ASM.