PT-2017-16911

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM software versions 12.1.2 and 13.0.0 Description The issue occurs under rare conditions where the BIG-IP APM system appends log details when responding to client requests. The details in the log file can vary. Customers running...

CVE-2017-6129: Improper Input Validation

In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail...

PT-2017-16907

Name of the Vulnerable Software and Affected Versions F5 BIG-IP software version 13.0.0 Description A slow memory leak may occur due to undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses, potentially leading to out of memory OOM conditions. Recommendations For...

PT-2017-16906

Name of the Vulnerable Software and Affected Versions F5 BIG-IP software versions 11.5.1 through 11.6.1 F5 BIG-IP software versions 12.1.0 through 12.1.2 F5 BIG-IP software version 13.0.0 Description The issue arises when an undisclosed sequence of packets from an adjacent network causes TMM to...

PT-2017-16910

Name of the Vulnerable Software and Affected Versions F5 BIG-IP software versions 12.1.0 through 12.1.2 F5 BIG-IP software version 13.0.0 Description The issue allows malicious requests made to virtual servers with an HTTP profile to cause the TMM to restart. This is exposed with BIG-IP APM...

PT-2017-16916

Name of the Vulnerable Software and Affected Versions F5 BIG-IP software version 13.0.0 Description The issue affects F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, and WebSafe software. Undisclosed requests made to BIG-IP virtual serve...

CVE-2017-6135: Missing Release of Resource after Effective Lifetime

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses may lead to out of memory OOM conditions...

F5 Networks BIG-IP : NTP vulnerability (K96670746)

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service ntpd crash via a malformed mode configuration directive. CVE-2017-6464 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP...

F5 Networks BIG-IP : NTP vulnerability (K31310492)

Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response. CVE-2017-6460 C Tenable Network Security, Inc. The descriptive text and package chec...

F5 Networks BIG-IP : LibTIFF vulnerabilities (K34527393)

CVE-2016-9533 tifpixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka 'PixarLog horizontalDifference heap-buffer-overflow.' CVE-2016-9534 tifwrite.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1 that...

F5 Networks BIG-IP : NTP vulnerability (K32262483)

The mx4200send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write...

F5 Networks BIG-IP : OpenSSH vulnerability (K20911042)

The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as...

F5 Networks BIG-IP : NTP vulnerability (K07082049)

Buffer overflow in the legacy Datum Programmable Time Server DPTS refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device. CVE-2017-6462 C Tenable Network Security, Inc. The descriptive text and package checks in...

F5 Networks BIG-IP : NTP vulnerability (K02951273)

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service daemon crash via an invalid setting in a :config directive, related to the unpeer option. CVE-2017-6463 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

F5 Networks BIG-IP : LibTIFF vulnerability (K11220361)

The NeXTDecode function in tifnext.c in LibTIFF allows remote attackers to cause a denial of service uninitialized memory access via a crafted TIFF image, as demonstrated by libtiff5.tif. CVE-2015-1547 Impact This vulnerability allows a remote attacker to cause a denial-of-service DoS attack.BIG-...

Apache vulnerability CVE-2017-6146

F5 Product Development has assigned ID 572272 BIG-IP and ID 663962 Enterprise Manager to this vulnerability. To determine if your product and version have been evaluated for this vulnerability, refer to the Applies to see versions box. To determine if your release is known to be vulnerable, the...

F5 Networks BIG-IP : OpenSSL vulnerability (K14363514)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0. It is, therefore, affected by a vulnerability as referenced in the K14363514 advisory. - There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g...

19-Year-Old TLS Vulnerability Weakens Website Crypto

A vulnerability called ROBOT, first identified in 1998, has resurfaced. Impacted are leading websites ranging from Facebook to Paypal, which are vulnerable to attackers that could decrypt encrypted data and sign communications using the sites’ own private encryption key. The vulnerability is foun...

F5 BIG-IP virtual server information disclosure vulnerability

F5 BIG-IP is an all-in-one network appliance from F5 Inc. that integrates network traffic management, application security management, load balancing and other functions. virtual server is one of the virtual servers. A security vulnerability exists in the virtual server with Client SSL profile in...

F5 Networks BIG-IP : BIG-IP FastL4 TMM vulnerability (K65615624)

In BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe software 12.0.0 to 12.1.1, in some cases the Traffic Management Microkernel TMM may crash when processing fragmented packets. This vulnerability affects TMM through a virtual server configured with a FastL4...