glibc vulnerability CVE-2015-8778

2016-04-0722:22:00

support.f5.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

85.6%

JSON

F5 Product Development has assigned ID 578983 (BIG-IP), CPF-19112 (Traffix SDC), and ID 476571 (ARX) to this vulnerability, and has evaluated the currently supported releases for potential vulnerability. Additionally, BIG-IP iHealth may list Heuristic H51079478 on the Diagnostics >Identified>Low page.

To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table.

Product	Versions known to be vulnerable	Versions known to be not vulnerable	Severity	Vulnerable component or feature
BIG-IP LTM	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.0.0 - 11.6.2
10.1.0 - 10.2.4	Low	glibc
BIG-IP AAM	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.4.0 - 11.6.2	Low	glibc
BIG-IP AFM	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.3.0 - 11.6.2	Low	glibc
BIG-IP Analytics	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.0.0 - 11.6.2	Low	glibc
BIG-IP APM	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.0.0 - 11.6.2
10.1.0 - 10.2.4	Low	glibc
BIG-IP ASM	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.0.0 - 11.6.2
10.1.0 - 10.2.4	Low	glibc
BIG-IP DNS	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2	Low	glibc
BIG-IP Edge Gateway	None	11.0.0 - 11.3.0
10.1.0 - 10.2.4	Not vulnerable	None
BIG-IP GTM	None	11.0.0 - 11.6.2
10.1.0 - 10.2.4	Not vulnerable	None
BIG-IP Link Controller	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.0.0 - 11.6.2
10.1.0 - 10.2.4	Low	glibc
BIG-IP PEM	14.0.0
13.0.0
12.0.0 - 12.1.3	14.1.0
13.1.0
13.0.1
12.1.3.2
11.3.0 - 11.6.2	Low	glibc
BIG-IP PSM	None	11.0.0 - 11.4.1
10.1.0 - 10.2.4	Not vulnerable	None
BIG-IP WebAccelerator	None	11.0.0 - 11.3.0
10.1.0 - 10.2.4	Not vulnerable	None
BIG-IP WOM	None	11.0.0 - 11.3.0
10.1.0 - 10.2.4	Not vulnerable	None
ARX	6.0.0 - 6.4.0	None	Low	glibc
Enterprise Manager	None	3.0.0 - 3.1.1	Not vulnerable	None
FirePass	None	7.0.0
6.0.0 - 6.1.0	Not vulnerable	None
BIG-IQ Cloud	None	4.0.0 - 4.5.0	Not vulnerable	None
BIG-IQ Device	None	4.2.0 - 4.5.0	Not vulnerable	None
BIG-IQ Security	None	4.0.0 - 4.5.0	Not vulnerable	None
BIG-IQ ADC	None	4.5.0	Not vulnerable	None
BIG-IQ Centralized Management	None	None	Not vulnerable	None
BIG-IQ Cloud and Orchestration	None	1.0.0	Not vulnerable	None
LineRate	None	2.5.0 - 2.6.1	Not vulnerable	None
F5 WebSafe	None	1.0.0	Not vulnerable	None
Traffix SDC	4.0.0 - 4.4.0
3.3.2 - 3.5.1	None	Low	glibc

If you are running a version listed in the Versions known to be vulnerablecolumn, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerablecolumn. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.

Mitigation

None