CVE-2018-5525: Exposure of Sensitive Information to an Unauthorized Actor

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5523: Undefined Security Weakness

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2018-15638)

F5 BIG-IP is a collection of software and hardware that allows you to control the traffic that passes through your network. A denial of service vulnerability exists in F5 BIG-IP 11.x, 12.x, and 13.x. A remote attacker could exploit this vulnerability by sending specially crafted TLS data to cause...

CVE-2018-5513: Improper Input Validation

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a disruption of service. This issue is only exposed on the data plane when Proxy SSL configuration is enabled. The control plane is not impact...

CVE-2018-5521: Improper Neutralization of Input During Web Page Generation

On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS...

PT-2018-17020

Name of the Vulnerable Software and Affected Versions F5 BIG-IP ASM versions 13.1.0 through 13.1.0.5 Description The issue occurs under certain conditions where Behavioral DOS BADOS protection may fail during an attack. Recommendations For versions 13.1.0 through 13.1.0.5, at the moment, there is...

CVE-2018-5526: Undefined Security Weakness

Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS BADOS protection may fail during an attack...

CVE-2018-5524: Undefined Security Weakness

Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profiles which make use of network hardware security module HSM functionality are exposed and impacted by this issue...

PT-2018-17019

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Configuration utility versions 11.2.1, 11.5.1 through 11.5.5, 11.6.1 through 11.6.3.1, 12.1.0 through 12.1.2, 13.0.0 Description A local file issue exists in the F5 BIG-IP Configuration utility that exposes files containing F5-provid...

PT-2018-17018

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 HF2 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.1 F5 BIG-IP versions 13.0.0 through 13.1.0.5 Description The issue affects virtual servers configured with Client SSL or Server SSL profiles that utilize...

PT-2018-17017

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1, 11.5.1 through 11.5.5, 11.6.1 through 11.6.3.1, 12.1.0 through 12.1.3.1, 13.0.0, 13.1.0 through 13.1.0.3 Enterprise Manager version 3.1.1 Description The issue affects authenticated administrative users who run...

PT-2018-17015

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 F5 BIG-IP versions 11.5.1 through 11.5.5 F5 BIG-IP versions 11.6.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.1 Description The issue allows carefully crafted URLs to reflect arbitrary content into GeoI...

PT-2018-17016

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 F5 BIG-IP versions 11.5.1 through 11.5.5 F5 BIG-IP versions 11.6.1 through 11.6.3.1 F5 BIG-IP versions 12.0.0 through 12.1.2 F5 BIG-IP version 13.0.0 Description The issue occurs when F5 BIG-IP processes DIAMETER...

CVE-2018-5522: Improper Input Validation

On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash...

PT-2018-17007

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 F5 BIG-IP versions 11.5.1 through 11.5.5 F5 BIG-IP versions 11.6.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.3 F5 BIG-IP versions 13.0.0 F5 BIG-IP versions 13.1.0 through 13.1.0.3 Description A malform...

CVE-2017-6153: Uncontrolled Resource Consumption

Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inflate code from PEM module are subjected to a service disruption via a "Zip Bomb" attack...

F5 Networks BIG-IP : Apache vulnerability (K00373024)

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-en...

F5 Networks BIG-IP : glibc vulnerability (K20486351)

glibc contains a vulnerability that allows specially crafted LDLIBRARYPATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap...

F5 Networks BIG-IP : Apache HTTPD vulnerability (K75429050)

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, modmime can read one byte past the end of a buffer when sending a malicious Content-Type response header. CVE-2017-7679 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5...

F5 Networks BIG-IP : PHP vulnerability (K75543432)

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zendinidoop function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input...