F5 Networks BIG-IP : OpenSSL vulnerability (K37526132)

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; user...

F5 Networks BIG-IP : libarchive vulnerability (K52697522)

The readHeader function in archivereadsupportformat7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service out-of-bounds read via multiple EmptyStream attributes in a header in a 7zip archive. CVE-2016-8689 C Tenable Network Security, Inc. The descriptive text and package...

F5 Networks BIG-IP : libarchive vulnerability (K35263486)

The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service crash via a crafted file, which triggers an invalid read in the 1 detectform or 2 bidentry function in...

F5 Networks BIG-IP : BIND vulnerability (K80533167)

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 - 9.9.9-S7, 9.9.3 - 9.9.9-P5, 9.9.10b1,...

F5 Networks BIG-IP : Linux kernel vulnerability (K17309)

The 1 udprecvmsg and 2 udpv6recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service EPOLLET epoll application read outage via an incorrect checksum in a UDP packet, a different vulnerability than...

F5 Networks BIG-IP : Linux kernel vulnerability (K17307)

The 1 udprecvmsg and 2 udpv6recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service system hang via incorrect checksums within a UDP packet flood. CVE-2015-5364 C Tenable Network Security, Inc. Th...

F5 Networks BIG-IP : Linux privilege-escalation vulnerability (K10558632) (Dirty COW)

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write COW feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka 'Dirty COW.' CVE-2016-5195...

F5 BIG-IP Information Disclosure Vulnerability

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP versions 12.0.0 and 11.5.0 through 11.6.1 where a REST request timeout...

F5 BIG-IP - OpenSSL vulnerability CVE-2017-3732

Multiple vulnerabilities in OpenSSL affecting F5 Big IP. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if descripti...

F5 BIG-IP - REST vulnerability CVE-2016-6249

F5 BIG-IP REST requests which timeout during user account authentication may log sensitive attributes such as password in plaintext to /var/log/restjavad.0.log. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

Design/Logic Flaw

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

CVE-2016-6249

Summary of CVE-2016-6249 (F5 BIG-IP REST vulnerability) Affected products/versions: F5 BIG-IP 12.0.0 and 11.5.0 – 11.6.1 (REST framework). The vendor advisory lists vulnerable and non‑vulnerable versions (e.g., 12.1.0–12.1.2 as not vulnerable) and enumerates affected modules under the REST framew...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

PT-2017-8942

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.0 through 11.6.1 F5 BIG-IP version 12.0.0 Description The issue allows local users to obtain sensitive information by reading log files. Specifically, REST requests that timeout during user account authentication may lo...

CVE-2016-6249: Exposure of Sensitive Information to an Unauthorized Actor

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

F5 Networks BIG-IP : OpenSSL vulnerability (K44512851)

There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed...

F5 Big-IP TLS Information Disclosure (Ticketbleed; CVE-2016-9244)

An information disclosure vulnerability has been reported in F5 Big-IP TLS products. An attacker can leverage this vulnerability to disclose memory contents of a connected server...

F5 Networks BIG-IP : NTP vulnerability (K20804323)

The MATCHASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value. CVE-2016-2518 Using a crafted packet to create a peer association with hmode 7 causes the MATCHASSOC lookup to...