The BIG-IP Core implementation must be configured to inspect for protocol compliance and protocol anomalies in inbound SMTP and Extended SMTP communications traffic to virtual servers.

From F5 BIG-IP Local Traffic Manager 11.x Security Technical Implementation Guide

Part of SRG-NET-000512-ALG-000064

Associated with: CCI-000366 CCI-001125

SV-74813r1_rule The BIG-IP Core implementation must be configured to inspect for protocol compliance and protocol anomalies in inbound SMTP and Extended SMTP communications traffic to virtual servers.

Vulnerability discussion

Application protocol anomaly detection examines application layer protocols such as SMTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols.Since protocol anomaly analysis examines the application payload for patterns or anomalies, an SMTP proxy must be included in the ALG. This ALG will be configured to inspect inbound SMTP and Extended SMTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.

Check content

If the BIG-IP Core does not provide intermediary/proxy services for SMTP communications traffic for virtual servers, this is not applicable. When intermediary/proxy services for SMTP communication traffic are provided, verify the BIG-IP Core is configured as follows: Verify the BIG-IP LTM module is configured to inspect for protocol compliance and protocol anomalies in inbound SMTP and Extended SMTP communications traffic. Navigate to the BIG-IP System manager >> Local Traffic >> Virtual Servers >> Virtual Servers List tab. Select a Virtual Server that has been configured as an SMTP proxy. Verify that "SMTP Profile" under the "Configuration" section is set to a locally configured SMTP profile. Verify the configuration of the selected SMTP profile: Navigate to the BIG-IP System manager >> Local Traffic >> Profiles >> Services >> SMTP. Select the SMTP profile that was to configure the Virtual Server. Verify that "Protocol Security" is Enabled under the "Settings" section. If the BIG-IP Core does not inspect inbound SMTP and Extended SMTP communications traffic for protocol compliance and protocol anomalies, this is a finding.

Fix text

If the BIG-IP Core provides intermediary/proxy services for SMTP communications traffic, configure the BIG-IP Core as follows: Configure the BIG-IP LTM module to inspect for protocol compliance and protocol anomalies in inbound SMTP and Extended SMTP communications traffic.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer