CVE-2016-9256

{"containers": {"cna": {"affected": [{"product": "BIG-IP", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "12.1.0-12.1.2"}]}], "datePublic": "2017-02-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change."}], "problemTypes": [{"descriptions": [{"description": "iControl vulnerability CVE-2016-9256", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-05-10T09:57:01.000Z", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K47284724"}, {"name": "96464", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/96464"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "f5sirt@f5.com", "ID": "CVE-2016-9256", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "BIG-IP", "version": {"version_data": [{"version_value": "12.1.0-12.1.2"}]}}]}, "vendor_name": "F5 Networks, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "iControl vulnerability CVE-2016-9256"}]}]}, "references": {"reference_data": [{"name": "https://support.f5.com/csp/article/K47284724", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K47284724"}, {"name": "96464", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96464"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:42:11.288Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K47284724"}, {"name": "96464", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/96464"}]}]}, "cveMetadata": {"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2016-9256", "datePublished": "2017-05-09T15:00:00.000Z", "dateReserved": "2016-11-09T00:00:00.000Z", "dateUpdated": "2024-08-06T02:42:11.288Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "BIG-IP", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "12.1.0-12.1.2"}]}], "source": "f5sirt@f5.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "44F1E5E0-BD63-4A4A-BC4E-A1D5495F8B5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "A82C7B1C-E195-4D94-B604-78FB464C4F81", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8F6C3144-D0DE-4248-BFCD-04A7E6104044", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "0357B5ED-0600-4756-93E5-692987068596", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3CA2FA6B-3930-432F-8FB5-E73604CEFE42", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "ECA90FB8-E2CD-400F-B753-1B482E7FAC96", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "6FEC804B-35DB-4A0C-9AEA-15527E0CC1B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "BEB228A9-0C01-4531-B2B2-38BB7B0E02E9", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "532AAF54-64EF-4852-B4F1-D5E660463704", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "BC827031-CA39-4081-8CE0-30EAC78DF756", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "7569903B-3A15-4A10-863B-6828337DD268", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "45825991-D17D-42F1-87B4-7DF86B098B45", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D0EDB8E9-E6FB-406E-B1D3-C620F114804C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "77192AFB-B612-4BAA-916C-3DF8E851CC2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "AE295AF6-2B35-467F-8501-B5753CDDE16C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E3C03B68-914F-4DB0-A832-B626B8746524", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3B62FEC0-EE22-46E6-B811-8AB0EE4C3E2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "FCD2044C-AC6F-4145-B1A0-8EB26DCF1F8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5FC866D4-CE8C-4408-AD1E-8643AC554CC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "7563D979-BE37-4251-B92E-0DBDBE53F3FF", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "62B0A70A-D101-443E-A543-5EC35E23D66F", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "2DB2118A-0F9C-4273-BB07-85FEA32C785B", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8541C9EF-69A8-4641-B173-3BCE0EDD20A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E24A3C71-0075-4738-B114-267337D050CD", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "524B2D05-508C-47FF-94A0-6CC42060E638", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "55DD7394-BD0A-42FD-A367-827F35397A20", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "98509F74-301A-4D1F-A2B4-B01B80CEFFCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E87FFF5F-5BB1-4E2F-BD15-3BA7C9B26FEA", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E90C12AF-44BA-44A2-89ED-0C2497EEC8A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "BBBB6E7C-DA1A-479F-9DD2-DE0C3CA82E92", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "4913B437-33FF-4B5E-A855-9DA00B35E3B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "EDCFE65B-340B-4F7D-93A1-4390BBC8E67F", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "23FF9627-E561-4CF7-A685-6E33D2F6C98C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "64273A2C-E5A1-4605-92DD-EBECC7F051D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "E60CA151-1C3A-45B3-B939-E6F80063C595", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "58BAD5A9-9C67-4056-9344-07C8C42C8E88", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "2EE1EEA6-1E25-4A90-91A1-386D19808557", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "16A05340-0AE2-49CA-903F-44383421577E", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "583F134E-1616-44F2-8EF0-0CFA5CCEF0AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "86D0731D-E9DA-4056-9AC6-F204C2F915F7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change."}, {"lang": "es", "value": "En F5 BIG-IP desde la versi\u00f3n 12.1.0 hasta la 12.1.2, los permisos forzados por iControl pueden quedar retrasados con respecto a los permisos reales asignados a un usuario si el role_map no se vuelve a cargar entre que se cambian los permisos y la siguiente petici\u00f3n del usuario. Esta es una condici\u00f3n de carrera que raramente se produce en el uso normal. El per\u00edodo t\u00edpico en el que esto es posible est\u00e1 limitado a un m\u00e1ximo de unos segundos despu\u00e9s del cambio de permiso."}], "id": "CVE-2016-9256", "lastModified": "2026-06-17T00:55:44.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-09T15:29:00.310", "references": [{"source": "f5sirt@f5.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/96464"}, {"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K47284724"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/96464"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K47284724"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}