ID de Prueba:	1.3.6.1.4.1.25623.1.0.140179
Categoría:	F5 Local Security Checks
Título:	F5 BIG-IP - PCRE library vulnerability CVE-2015-5073
Resumen:	Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.
Descripción:	Summary: Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. Vulnerability Impact: A local, authenticated attacker may be able to provide malicious input in the configuration to exploit this vulnerability. There is no data plane exposure to this issue. Solution: See the referenced vendor advisory for a solution. CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5073 BugTraq ID: 75430 http://www.securityfocus.com/bid/75430 https://security.gentoo.org/glsa/201607-02 http://www.openwall.com/lists/oss-security/2015/06/26/1 http://www.openwall.com/lists/oss-security/2015/06/26/3 RedHat Security Advisories: RHSA-2016:1025 http://rhn.redhat.com/errata/RHSA-2016-1025.html RedHat Security Advisories: RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132 RedHat Security Advisories: RHSA-2016:2750 http://rhn.redhat.com/errata/RHSA-2016-2750.html http://www.securitytracker.com/id/1033154 Common Vulnerability Exposure (CVE) ID: CVE-2016-9244 BugTraq ID: 96143 http://www.securityfocus.com/bid/96143 https://www.exploit-db.com/exploits/41298/ http://packetstormsecurity.com/files/141017/Ticketbleed-F5-TLS-Information-Disclosure.html https://blog.filippo.io/finding-ticketbleed/ https://filippo.io/Ticketbleed/ https://github.com/0x00string/oldays/blob/master/CVE-2016-9244.py http://www.securitytracker.com/id/1037800
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.