PT-2018-17009

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.0.0 through 13.1.0.5 Description The issue occurs when using RADIUS authentication responses from a RADIUS server with IPv6 addresses, which may cause TMM to crash and lead to a failover event. Recommendations For version...

PT-2018-17014

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.1 F5 BIG-IP versions 13.0.0 through 13.1.0.5 Description The issue allows an administrative user to gain unauthorized access to file system resources using the...

PT-2018-17012

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.0.0 through 12.1.3.3 F5 BIG-IP versions 13.0.0 through 13.1.0.5 Description The issue allows malicious root users with access to a VCMP guest to cause a disruption of service on adjacent VCMP guests running on the same...

PT-2018-17006

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.0 through 13.1.0.5 Description The issue occurs when Large Receive Offload LRO and SYN cookies are enabled, which are default settings. Undisclosed traffic patterns may cause the Traffic Management Microkernel TMM to...

PT-2018-17008

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.0 through 13.1.0.5 Description The issue allows maliciously crafted HTTP/2 request frames to cause a denial of service. This exposure is specific to the data plane for virtual servers when the HTTP2 profile is enabled...

PT-2018-17010

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.2 F5 BIG-IP versions 13.0.0 through 13.1.0.5 Enterprise Manager version 3.1.1 BIG-IQ Centralized Management versions 4.6.0 BIG-IQ Centralized Management versions...

PT-2018-17013

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.3 F5 BIG-IP versions 13.0.0 through 13.1.0.5 Description Administrative users can exploit the ssldump utility to write to arbitrary file paths using undisclose...

PT-2018-17011

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.0 through 13.1.0.5 Description The issue is caused by malformed TCP packets sent to a self IP address or a FastL4 virtual server, which may result in an interruption of service. This issue affects the data plane virtual...

CVE-2018-5519: Undefined Security Weakness

On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.3, or 11.2.1-11.6.3.1, administrative users by way of undisclosed methods can exploit the ssldump utility to write to arbitrary file paths. For users who do not have Advanced Shell access for example, any user when licensed for Appliance Mode, this allo...

CVE-2018-5514: Improper Input Validation

On F5 BIG-IP 13.1.0-13.1.0.5, maliciously crafted HTTP/2 request frames can lead to denial of service. There is data plane exposure for virtual servers when the HTTP2 profile is enabled. There is no control plane exposure to this issue...

CVE-2018-5512: Undefined Security Weakness

On F5 BIG-IP 13.1.0-13.1.0.5, when Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart...

Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-09411 )

F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. There are security vulnerabilities in several F5 products. When a system is configured with a wildcard IPSec channel endpoint, a remote attacker...

Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-09413)

F5 BIG-IP LTM, etc. are products of F5 Corporation, U.S.A. F5 BIG-IP LTM is a local traffic manager; BIG-IP AAM is an application acceleration manager. A security vulnerability exists in several F5 products. An attacker could exploit the vulnerability to cause a denial of service...

Traffic Management Microkernel Denial of Service Vulnerability in Multiple F5 Products (CNVD-2018-09407)

F5 BIG-IP Analytics is a suite of Web application performance analytics software from F5 Corporation, USA. The software provides detailed analysis of performance metrics such as transactions per second, server latency, page load time and response throughput, etc. Traffic Management Microkernel TM...

Design/Logic Flaw

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure...

Code injection

On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel TMM may restart when processing a specific sequence of packets on IPv6 virtual servers...

CVE-2017-6148

Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane i...

CVE-2017-6155

On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure...

CVE-2017-6158

In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses...

CVE-2017-6143

X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5...