描述:
F5 发布了安全公告以应对发现于 F5 装置中的多个漏洞。有关漏洞及其相关修补的详情可参考以下网址：
https://support.f5.com/csp/article/K50974556
有报告指 F5 BIG-IP 的漏洞 (CVE-2021-23031) 容许通过认证的攻击者在受影响的系统中进行权限提升。系统管理员应立即为受影响的系统安装修补程式，以减低受到网络攻击的风险。
受影响的系统:
- BIG-IP 16.0.0-16.0.1 版本
- BIG-IP 15.1.0-15.1.2 版本
- BIG-IP 14.1.0-14.1.4 版本
- BIG-IP 13.1.0-13.1.4 版本
- BIG-IP 12.1.0-12.1.6 版本
- BIG-IP 11.6.1-11.6.5 版本
- BIG-IQ 8.0.0-8.1.0 版本
- BIG-IQ 7.0.0-7.1.0 版本
- BIG-IQ 6.0.0-6.1.0 版本
- BIG-IP Advanced WAF/ASM 16.0.0-16.0.1 版本
- BIG-IP Advanced WAF/ASM 15.1.0-15.1.3 版本
- BIG-IP Advanced WAF/ASM 14.1.0-14.1.4.1 版本
- BIG-IP Advanced WAF/ASM 13.1.0-13.1.4 版本
- BIG-IP Advanced WAF/ASM 12.1.0-12.1.6 版本
- BIG-IP Advanced WAF/ASM 11.6.1-11.6.5 版本
- BIG-IP Guided Configuration 7.0 版本
- BIG-IP Guided Configuration 6.0 版本
- BIG-IP Guided Configuration 5.0 版本
- BIG-IP Guided Configuration 4.1 版本
- BIG-IP Guided Configuration 3.0 版本
影响:
成功利用这些漏洞可以在受影响的系统导致远端执行指令码、跨网址程式编程、数据操纵、服务受阻断、泄漏资讯、权限提升、仿冒诈骗、终止系统执行或绕过保安限制。
建议:
适用于受影响系统的软件更新已可获取。受影响系统的系统管理员应遵从产品供应商的建议，立即采取行动以降低风险。建议咨询产品供应商以取得修补程式及有关支援。
系统管理员应遵循良好作业模式，仅允许管理人员通过安全网络访问产品，并限制对受信任用户的外壳访问。
进一步信息:
- https://www.hkcert.org/tc/security-bulletin/f5-big-ip-multiple-vulnerabilities_20210826
- https://us-cert.cisa.gov/ncas/current-activity/2021/08/25/f5-releases-august-2021-security-advisory
- https://support.f5.com/csp/article/K00602225
- https://support.f5.com/csp/article/K01153535
- https://support.f5.com/csp/article/K05043394
- https://support.f5.com/csp/article/K05314769
- https://support.f5.com/csp/article/K05391775
- https://support.f5.com/csp/article/K14903688
- https://support.f5.com/csp/article/K19012930
- https://support.f5.com/csp/article/K21435974
- https://support.f5.com/csp/article/K24301698
- https://support.f5.com/csp/article/K30150004
- https://support.f5.com/csp/article/K30291321
- https://support.f5.com/csp/article/K30523121
- https://support.f5.com/csp/article/K32734107
- https://support.f5.com/csp/article/K35408374
- https://support.f5.com/csp/article/K36942191
- https://support.f5.com/csp/article/K42051445
- https://support.f5.com/csp/article/K42526507
- https://support.f5.com/csp/article/K44553214
- https://support.f5.com/csp/article/K45407662
- https://support.f5.com/csp/article/K48321015
- https://support.f5.com/csp/article/K49549213
- https://support.f5.com/csp/article/K50974556
- https://support.f5.com/csp/article/K52420610
- https://support.f5.com/csp/article/K53854428
- https://support.f5.com/csp/article/K55543151
- https://support.f5.com/csp/article/K61643620
- https://support.f5.com/csp/article/K63163637
- https://support.f5.com/csp/article/K65397301
- https://support.f5.com/csp/article/K66782293
- https://support.f5.com/csp/article/K70415522
- https://support.f5.com/csp/article/K70652532
- https://support.f5.com/csp/article/K79428827
- https://support.f5.com/csp/article/K93231374
- https://support.f5.com/csp/article/K94255403
- https://support.f5.com/csp/article/K94941221
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5862
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23025 (to CVE-2021-23053)