TMM vulnerability CVE-2017-6137

2017-05-0601:15:00

support.f5.com

0.001 Low

EPSS

Percentile

46.3%

JSON

F5 Product Development has assigned ID 635412 (BIG-IP) to this vulnerability. Additionally, BIG-IP iHealth may list Heuristic H82851041 on the Diagnostics >Identified>Medium page.

To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table.

Product	Versions known to be vulnerable	Versions known to be not vulnerable	Severity	Vulnerable component or feature
BIG-IP LTM	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1
13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1
11.2.1	Medium	TMM
BIG-IP AAM	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1	Medium	TMM
BIG-IP AFM	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1	Medium	TMM
BIG-IP Analytics	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1
11.2.1	Medium	TMM
BIG-IP APM	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1
11.2.1	Medium	TMM
BIG-IP ASM	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1
11.2.1	Medium	TMM
BIG-IP DNS	12.1.0 - 12.1.2
12.0.0 HF3 - HF4	13.0.0
12.1.2 HF1	Medium	TMM
BIG-IP Edge Gateway	None	11.2.1	Not vulnerable	None
BIG-IP GTM	11.6.1 HF1	11.6.1 HF2
11.4.0 - 11.6.1
11.2.1	Medium	TMM
BIG-IP Link Controller	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1
11.2.1	Medium	TMM
BIG-IP PEM	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.4.0 - 11.6.1	Medium	TMM
BIG-IP PSM	None	11.4.0 - 11.4.1	Not vulnerable	None
BIG-IP WebAccelerator	None	11.2.1	Not vulnerable	None
BIG-IP WebSafe	12.1.0 - 12.1.2
12.0.0 HF3 - HF4
11.6.1 HF1	13.0.0
12.1.2 HF1
11.6.1 HF2
11.6.0 - 11.6.1	Medium	None
ARX	None	6.2.0 - 6.4.0	Not vulnerable	None
Enterprise Manager	None	3.1.1	Not vulnerable	None
BIG-IQ Cloud	None	4.4.0 - 4.5.0	Not vulnerable	None
BIG-IQ Device	None	4.4.0 - 4.5.0	Not vulnerable	None
BIG-IQ Security	None	4.4.0 - 4.5.0	Not vulnerable	None
BIG-IQ ADC	None	4.5.0	Not vulnerable	None
BIG-IQ Centralized Management	None	5.0.0 - 5.2.0
4.6.0	Not vulnerable	None
BIG-IQ Cloud and Orchestration	None	1.0.0	Not vulnerable	None
F5 iWorkflow	None	2.0.0 - 2.1.0	Not vulnerable	None
LineRate	None	2.5.0 - 2.6.2	Not vulnerable	None
Traffix SDC	None	5.0.0 - 5.1.0
4.0.0 - 4.4.0	Not vulnerable	None

If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in theVersions known to be not vulnerable column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.

Mitigation

To mitigate this vulnerability, you can disable TMM fast forward flows. To do so, perform the following procedure:

Impact of workaround: Performing the following procedure requires that you reboot the BIG-IP system. The**tmm.ffwd.enable **database variable allows a TMM at 100 percent capacity to forward connections to a TMM under less intensive CPU load.