K52035247 : BIG-IP DNS virtual server vulnerability CVE-2020-27721

Security Advisory Description

In a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response. (CVE-2020-27721)

This can occur under the following conditions:

• You configure connection rate limiting by either source or destination address for a BIG-IP LTM virtual server.
• The configured connection rate limit is exceeded on the BIG-IP LTM virtual server (or Pool Member or Node), and the status of the virtual server on the Configuration utility becomes yellow.

Impact

An attacker can exploit this vulnerability to cause the BIG-IP LTM virtual server to be marked as unavailable (yellow on the Configuration utility) resulting in a denial of DNS service (DoS) for all clients of the virtual server.