News
Vigil@nce - F5 BIG-IP: information disclosure via TLS
April 2017 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
A local attacker can read a memory fragment via the TLS signaling
of F5 BIG-IP, in order to get sensitive information.
Impacted products: BIG-IP Hardware, TMOS.
Severity: 2/4.
Creation date: 10/02/2017.
DESCRIPTION OF THE VULNERABILITY
The F5 BIG-IP product includes a TLS client.
However, when the TLS option "Session Tickets" does not have the
vendor defined default value, the content of an uninitialized
memory area of length at most 31 bytes, is returned to the client.
A local attacker can therefore read a memory fragment via the TLS
signaling of F5 BIG-IP, in order to get sensitive information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/F5-BIG-IP-information-disclosure-via-TLS-21800
