CVE-2016-9251

In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection...

CVE-2016-9251

CVE-2016-9251 affects F5 BIG-IP 12.0.0–12.1.2, where an authenticated attacker can escalate privileges via a crafted iControl REST connection. The vulnerability affects multiple BIG-IP modules using iControl REST (e.g., LTM, AAM, AFM, Analytics, APM, etc.) and is triggered by domain-specific REST...

PT-2017-10026

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.1.0 through 12.1.2 Description The issue is related to a race condition that occurs when permissions enforced by iControl lag behind the actual permissions assigned to a user. This happens if the role map is not reloaded...

CVE-2016-9257: Improper Neutralization of Input During Web Page Generation

In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to...

CVE-2016-9256: Concurrent Execution using Shared Resource with Improper Synchronization

In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the rolemap is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal...

PT-2017-10025

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.1.0 through 12.1.2 Description The issue is related to specific websocket traffic patterns that may cause a disruption of service for virtual servers configured to use the websocket profile. Recommendations For F5 BIG-IP...

CVE-2016-9253: Improper Input Validation

In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile...

PT-2017-10508

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 12.0.0 through 12.1.2 F5 BIG-IP APM version 13.0.0 Description An issue exists where an authenticated user with an established access session to the BIG-IP APM system may cause a traffic disruption if the length of the...

CVE-2016-9251: Undefined Security Weakness

In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection...

CVE-2017-0302: Incorrect Access of Indexable Resource

In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters...

CVE-2017-6137: Undefined Security Weakness

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disrupti...

PT-2017-10027

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 12.0.0 through 12.1.2 Description The issue allows non-authenticated users to inject JavaScript into a request, which is then rendered and executed in the context of the Administrative user when viewing the Access System...

PT-2017-10023

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.0.0 through 12.1.2 Description An authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection. Recommendations For versions 12.0.0 through 12.1.2, update to a version...

PT-2017-16909

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2 Description The issue concerns undisclosed traffic patterns that may disrupt the service to the Traffic Management Microkernel TMM when software SYN cookie...

F5 Networks BIG-IP : Insufficient validation of ICMP error messages (K23440942)

The vulnerability described in this article was initially fixed in earlier versions, but a regression was reintroduced in BIG-IP 12.x through13.x. For information about earlier versions, refer toK4583: Insufficient validation of ICMP error messages - VU222750 / CVE-2004-07909.x - 10.x. Multiple...

F5 Networks BIG-IP : BIG-IP management vulnerability (K55792317)

In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism. CVE-2016-9250 Impact An unauthenticated user with access to the management control plane may be...

F5 Networks BIG-IP : Websocket profile vulnerability (K51351360)

In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile. CVE-2016-9253 Note : Virtual servers configured to use the HTTP profile and no websocket profile that process websocket traffic ar...

F5 Networks BIG-IP : BIG-IP APM redirect vulnerability (K87141725)

Insufficient boundary checks on the request URL may cause the tmm process to assert when the user is redirected back to the original request URL following successful authentication to the BIG-IP APM system. CVE-2017-0302 Impact An authenticated user with an established access session to the BIG-I...

F5 Networks BIG-IP : TMM vulnerability (K82851041)

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection is engaged may cause a disrupti...

F5 Networks BIG-IP : Linux kernel vulnerability (K82224417) Deprecated

The packetsetring function in net/packet/afpacket.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service overflow or possibly have unspecified other impact via crafted system calls. CVE-2017-7308 - No F5 Syste...