Orange Business Services
Vigil@nce Vigil@nce Vigil@nce
we track for your security since 1999
  home presentation vulnerabilities documentation contact  
subscriber area subscriber area
free access free access
The Vigil@nce team watches vulnerabilities impacting your computers, and then offers solutions, a database and tools to correct them.
recent vulnerabilities recent vulnerabilities
tracked products tracked products
RSS feed RSS feed

vulnerability alert CVE-2013-6016

F5 BIG-IP: denial of service of TMM via TCP

Synthesis of the vulnerability

An attacker can initialize a TCP session to F5 BIG-IP, in order to trigger a denial of service.
Impacted products: BIG-IP Appliance.
Severity: 2/4.
Creation date: 17/10/2013.
Identifiers: BID-63245, CVE-2013-6016, SOL13233, VIGILANCE-VUL-13616.

Description of the vulnerability

The TMM (Traffic Management Microkernel) manages the load balancing.

The establishment of a TCP session requires three packets:
 - SYN
 - ACK

However, in some cases, BIG-IP transits the TCP session to the ESTABLISHED state, before receiving the ACK packet. This error then leads to a segmentation error, or to an assertion of TMM.

An attacker can therefore initialize a TCP session to F5 BIG-IP, in order to trigger a denial of service.
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

Delicious Digg Facebook Google bookmarks LinkedIn Mail Reddit StumbleUpon Technorati Twitter 

Computer vulnerabilities tracking service

Vigil@nce provides a network vulnerability alert. Each administrator can customize the list of products for which he wants to receive vulnerability alerts. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.

Copyright 1999-2014 Vigil@nce. Vigil@nce is a service from Orange Business Services. Site map. Legal notice. Version française