Last Modified: Dec 20, 2018
See more info
Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168
Opened: Jul 24, 2018
When brute force attack is detected and prevented by asm, asm continue to prevent login attempts even the attacking traffic has stopped 5 minutes ago.
ASM doesn't report that brute force attack is finished and logins mitigation continues to occur.
- ASM provisioned - ASM policy attached to a virtual server - ASM Brute Force protection enabled in the asm policy - There is an ongoing brute force attack on the backend server.
While ongoing endless brute force attack, change an arbitrary field in brute force configuration and apply policy. Brute force attack end event will be triggered and the system will stop brute force prevention, if the attacking traffic still being sent, new brute force attack event will be raised and the mitigation will reoccur.
Fix brute force end condition check for a case when only successful logins are sent.