F5 Networks BIG-IP : BIG-IP APM VPN vulnerability (K20087443)

In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail...

F5 Networks BIG-IP : BIG-IP APM redirect vulnerability (K66171422)

Aninsecure AES ECB mode is usedfor origuri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts. CVE-2018-5548 Impact An attacker can forge a URL with an...

F5 Networks BIG-IP : BIG-IP APM SAML IdP vulnerability (K05018525)

APMD may core when processing SAML Assertion or response containing certain elements.CVE-2018-5549 Impact This vulnerability allows a disruption of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution...

F5 Networks BIG-IP : BIG-IP APM CRL vulnerability (K34652116)

In some situations, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system failsto download a new Certificate Revocation List.CVE-2018-15326. Impact Users with revoked certificatesmay be able to gain access to the system. C Tenable Network Security,...

F5 Networks BIG-IP : BIG-IP APM client for Linux and macOS vulnerability (K54431371)

The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to getownership of files owned by root on the local client host.CVE-2018-5546 Impact A malicious, local, unprivileged user...

F5 Networks BIG-IP : TMM vulnerability (K27044729)

Under certain conditions, theTraffic Management Microkernel TMM may restart and produce a core file while processing BIG-IP APM data. CVE-2018-5528 Impact This vulnerability allows remote attackers to cause a denial of service DoS on the BIG-IP system. The BIG-IP system will temporarily fail to...

F5 Networks BIG-IP : BIG-IP APM Portal Access vulnerability (K54358225)

In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K23024812)

When the BIG-IP APM system renders certain pages with a logon agent or a confirm box, the system may disclose configuration information such as partition and agent names via URI parameters. CVE-2018-5544 Impact This vulnerability allows unauthorized disclosure of information. C Tenable Network...

CVE-2018-15326

In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List...

Code injection

In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List...

Design/Logic Flaw

On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access...

CVE-2018-15324

On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access...

CVE-2018-15326

Mode C: CVE-2018-15326 affects BIG-IP APM applying CRLDP authentication; the policy agent may treat revoked certs as valid if the system cannot download a new CRL. Vulnerable versions include BIG-IP APM 14.x (14.0.0–14.0.0.2, 14.0.0.3 listed as vulnerable; fixes introduced in 14.1.0), 13.x (13.0....

CVE-2018-15324

CVE-2018-15324 affects BIG-IP APM: specifically TMM may restart when processing a specially crafted request via APM portal access. Affected versions are BIG-IP APM 14.0.0–14.0.0.2 and 13.0.0–13.1.1.1. Remediation per the security advisory is to upgrade to: 14.1.0 (for 14.x) or 13.1.1.2 (for 13.x)...

CVE-2018-15326

In some situations on BIG-IP APM 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.2, the CRLDP Auth access policy agent may treat revoked certificates as valid when the BIG-IP APM system fails to download a new Certificate Revocation List...

CVE-2018-15324

On BIG-IP APM 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, TMM may restart when processing a specially crafted request with APM portal access...

CVE-2018-15316

In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks...

Design/Logic Flaw

In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks...

CVE-2018-15316

The CVE-2018-15316 issue affects BIG-IP APM Edge Client where the policy library is loaded with user permission, bypassing endpoint checks. Affected are: BIG-IP APM 13.0.0–13.1.1.1 , APM Client 7.1.5–7.1.6 , and Edge Client 7101–7160 . The underlying cause is loading a library into the policy ser...

CVE-2018-15316

In F5 BIG-IP APM 13.0.0-13.1.1.1, APM Client 7.1.5-7.1.6, and/or Edge Client 7101-7160, the BIG-IP APM Edge Client component loads the policy library with user permission and bypassing the endpoint checks...