For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

wazir's avatar
wazir
Icon for Altostratus rankAltostratus
Jul 05, 2019

MongoDB Service Without Authentication Detection

DescriptionMongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without any authentication. A remote attacker can therefore connect...
application delivery
devops
F5 Rules for AWS WAF
security
WebSafe
Nathan_F__F5_'s avatar
Nathan_F__F5_
Icon for Employee rankEmployee
Jul 11, 2019

Hi wazir,

 

If I am understanding the description correctly then the attacker would need access to the database itself. I believe that this would mean your F5 device should be safe as long as the attacker can't login to the device. I would recommend that you simply ensure that access to the device is secure. The following article should hopefully be useful.

 

K13092: Overview of securing access to the BIG-IP system

https://support.f5.com/csp/article/K13092

 

-Nathan F