CVE-2020-27728 : Security Advisory and Response

On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a vulnerability exists that could lead to a Denial of Service (DoS) condition.

Understanding CVE-2020-27728

This CVE affects BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, potentially causing the Analytics, Visibility, and Reporting daemon (AVRD) to generate a core file and restart when processing requests from mobile devices.

What is CVE-2020-27728?

The vulnerability in BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3 may trigger AVRD to create a core file and restart during the handling of requests from mobile devices.

The Impact of CVE-2020-27728

The vulnerability could result in a DoS condition, potentially disrupting the availability of the affected systems.

Technical Details of CVE-2020-27728

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

Under specific conditions, the AVRD component on the mentioned versions of BIG-IP ASM & Advanced WAF may encounter issues leading to core file generation and system restarts.

Affected Systems and Versions

BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1
BIG-IP ASM & Advanced WAF versions 15.1.0-15.1.0.5
BIG-IP ASM & Advanced WAF versions 14.1.0-14.1.3

Exploitation Mechanism

The vulnerability can be exploited by sending specific requests from mobile devices, triggering the AVRD to malfunction.

Mitigation and Prevention

Protecting systems from CVE-2020-27728 is crucial to ensure security and availability.

Immediate Steps to Take

Apply vendor-provided patches or updates promptly.
Monitor system logs for any unusual AVRD behavior.
Implement network-level controls to mitigate potential exploitation.

Long-Term Security Practices

Regularly update and patch all software and firmware components.
Conduct security assessments and audits to identify vulnerabilities proactively.
Educate system administrators on best practices for secure system configuration.

Patching and Updates

F5 has released patches to address the vulnerability; ensure timely application to mitigate the risk of exploitation.