K32121038 : BIG-IP mcpd vulnerability CVE-2020-5876

Security Advisory Description

A race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer, adding a new peer, or when the Traffic Management Microkernel (TMM) first starts up. (CVE-2020-5876)

Impact

The race condition gives a small window of opportunity for an attacker to takeover the connection and spoof a trusted peer device to extract and/or modify sensitive information on the system. This vulnerability is only present when the BIG-IP system is configured as part of a ConfigSync high availability (HA) device group.