SOL54211024 - OpenSSL vulnerability CVE-2016-6304

Vulnerability Recommended Actions

If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in theVersions known to be not vulnerable column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.

To determine the necessary upgrade path for your BIG-IQ system, you should understand the BIG-IQ product offering name changes. For more information, refer to SOL21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems.

Mitigation

To mitigate this vulnerability, you can restrict network access to the big3d network port, TCP 4353.

Impact of action: TCP port 4353 is used to transfer sync-group data between BIG-IP devices. Any changes should be tested to ensure compatibility in your environment.

Supplemental Information

• SOL9970: Subscribing to email notifications regarding F5 products
• SOL9957: Creating a custom RSS feed to view new and updated documents
• SOL4602: Overview of the F5 security vulnerability response policy
• SOL4918: Overview of the F5 critical issue hotfix policy
• SOL13703: Overview of big3d version management
• SOL13092: Overview of securing access to the BIG-IP systemÂ