On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Big-ip_access_policy_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_access_policy_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_advanced_firewall_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_advanced_firewall_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_analytics | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_analytics | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_application_acceleration_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_application_acceleration_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_application_security_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_application_security_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_domain_name_system | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_domain_name_system | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_fraud_protection_service | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_fraud_protection_service | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_global_traffic_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_global_traffic_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_link_controller | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_link_controller | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_local_traffic_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_local_traffic_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
| Big-ip_policy_enforcement_manager | F5 | 14.1.0 (including) | 14.1.3 (excluding) |
| Big-ip_policy_enforcement_manager | F5 | 15.1.0 (including) | 15.1.4 (excluding) |
Potential Mitigations
- Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
- Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).