Vulnerability CVE-2021-23013

Vulnerability Name:

CVE-2021-23013 (CCN-200923)

Assigned:

2021-04-28

Published:

2021-04-28

Updated:

2022-07-12

Summary:

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.4 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2021-23013

Source: XF
Type: UNKNOWN
f5-cve202123013-dos(200923)

Source: MISC
Type: Not Applicable, Vendor Advisory
https://support.f5.com/csp/article/K04234247

Source: CCN
Type: F5 Security Advisory K05300051
TMM SCTP vulnerability CVE-2021-23013

Source: MISC
Type: Vendor Advisory
https://support.f5.com/csp/article/K05300051

Vulnerable Configuration:

Configuration 1:

cpe:/a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (Version >= 16.0.0 and < 16.0.1.1)

OR cpe:/a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

OR cpe:/a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.3)

OR cpe:/a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.3)

OR cpe:/a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.4)

OR cpe:/a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.4)

Configuration CCN 1:

cpe:/a:f5:big-ip:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip:13.1.0:*:*:*:*:*:*:*

OR cpe:/o:f5:big-ip:12.1.5:*:*:*:*:*:*:*

OR cpe:/o:f5:big-ip:15.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip:14.1.0:*:*:*:*:*:*:*

OR cpe:/o:f5:big-ip:13.1.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK