A vulnerability similar to the well-known heartbleed was discovered in the TLS/SSL stack of F5 BIG-IP appliances that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time. This vulnerability is called Ticketbleed as it lies in the implementation of Session Tickets, which is a resumption technique used to speed up repeated connections. The vulnerability affects the proprietary F5 TLS stack which exposes 31 bytes at a time.
F5 published article K05121675 addressing this vulnerability. You can read the story of how Ticketbleed was found and a complete technical walkthrough on the Filippo.io blog.
Test
You can test your domain using the automated script which you can find at: https://filippo.io/Ticketbleed/
Alternatively, you can test for Ticketbleed yourself with a Go script: here
Fixes and mitigation
The full list of affected versions is available on the F5 website. At the time of this public disclosure not all releases have upgrade candidates available.
Disabling Session Tickets is a complete mitigation, which will only cause a performance degradation in the set-up phase of resumed connections.
Reproduced here are the instructions provided by F5 and available at the link above.
- Log in to the Configuration utility
- Navigate on the menu to Local Traffic > Profiles > SSL > Client
- Toggle the option for Configuration from Basic to Advanced
- Uncheck the Session Ticket option to disable the feature
- Click Update to save the changes
Source: https://filippo.io/Ticketbleed/
No comments:
Post a Comment