F5 Networks BIG-IP : TMM vulnerability (K64208870)

Malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default 'normalize URI' configuration options used in iRules and/or BIG-IP LTM policies. CVE-2018-15319 Impact An attacker may be able to disrupt traffic or cause the...

F5 Networks BIG-IP : Apache Portable Runtime vulnerability (K52319810)

When aprtimeexp or aprosexptime functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an aprtimeexpt value, potentially revealing the contents of a different static heap value or...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K00363258)

A local file vulnerability exists in the BIG-IP Configuration utility that exposes files containing F5-provided data only, and do not include configuration data, proxied traffic, or other potentially sensitive customer data. CVE-2018-5525 Impact Authenticated users may be able to retrieve files...

F5 Networks BIG-IP : TMOS vulnerability (K49440608)

When a specifically configured virtual server receives traffic of an undisclosed nature, the Traffic Management Microkernel TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration that exposes this issue is not common and in general does...

F5 Networks BIG-IP : big3d vulnerability (K82038789)

The big3d process does not irrevocably minimize group privileges at startup. CVE-2018-5540 Impact There is not a known attack vector, but if the big3d process is compromised, it is possible for it to regain the group privileges it was launched with. C Tenable Network Security, Inc. The descriptiv...

F5 Networks BIG-IP : Oracle Java SE vulnerability (K70321874)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker wi...

F5 Networks BIG-IP : Appliance mode tmsh access vulnerability (K02043709)

On a BIG-IP system configured in Appliance mode, the TMOS Shell tmsh may allow an administrative user to use the dig utility to gain unauthorized access to file system resources. CVE-2018-5520 Note : Appliance mode is designed to meet the needs of customers in especially sensitive sectors by...

F5 Networks BIG-IP : GeoIP vulnerability (K23124150)

Carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS. CVE-2018-5521 Impact BIG-IP Clients accessing the affected system may be exposed to cross-site scripting XSS attacks. This vulnerability does not affect data plane...

F5 Networks BIG-IP : BIG-IP tmsh vulnerability (K01067037)

When BIG-IP is licensed for Appliance mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance mode restrictions to overwrite critical system files. CVE-2018-15321 Attackers with ahigh-privilege level can overwrite critical system files, which in turnbypasses security controls...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K23024812)

When the BIG-IP APM system renders certain pages with a logon agent or a confirm box, the system may disclose configuration information such as partition and agent names via URI parameters. CVE-2018-5544 Impact This vulnerability allows unauthorized disclosure of information. C Tenable Network...

F5 Networks BIG-IP : BADoS vulnerability (K62201098)

Under certain conditions, Behavioral DoS BADoS protection may fail during an attack. CVE-2018-5526 Impact BADoS protection does not function as intended. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K20222812)

When authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. CVE-2018-15327 Impact BIG-IP and Enterprise Manager This vulnerability allowsa privilege...

F5 Networks BIG-IP : TMM vulnerability (K16248201)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.3.7 / 13.1.1.2 / 14.0.0.3 / 14.1.0. It is, therefore, affected by a vulnerability as referenced in the K16248201 advisory. - In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection...

F5 Networks BIG-IP : BIG-IP ASM data processing vulnerability (K38243073)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.3 / 12.1.3.2 / 13.1.0. It is, therefore, affected by a vulnerability as referenced in the K38243073 advisory. - On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may...

F5 Networks BIG-IP : TMM vulnerability (K10930474)

Malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure. CVE-2017-6155 Impact An attacker may be able to disrupt traffic or cause the BIG-IP system ...

F5 Networks BIG-IP : BIG-IP AFM vulnerability (K20682450)

X509 certificate verification was not correctly implementedin the early access 'user id' feature in the BIG-IP Advanced Firewall Manager, and thus did not properly validate the remote server's identity on certain versions of BIG-IP. CVE-2017-6142 Impact In affected BIG-IP AFM versions, the system...

F5 Networks BIG-IP : BIG-IP APM SAML IdP vulnerability (K05018525)

APMD may core when processing SAML Assertion or response containing certain elements.CVE-2018-5549 Impact This vulnerability allows a disruption of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution...

F5 Networks BIG-IP : TMUI vulnerability (K30500703)

When authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. CVE-2018-5511 Impact This vulnerability allowsa privilege escalation for authenticated...

F5 Networks BIG-IP : Linux kernel vulnerability (K17403481)

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for DB exceptions that are deferred by MOV SS or POP SS, as demonstrated ...

F5 Networks BIG-IP : BIG-IP ASM vulnerability (K75432956)

Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF protections, the BIG-IP ASM bd process may restart and produce a core file. CVE-2018-5539 Impact BIG-IP The affected BIG-IP ASM system fails to process...