CVE-2018-5505

On F5 BIG-IP versions 13.1.0 - 13.1.0.3, when ASM and AVR are both provisioned, TMM may restart while processing DNS requests when the virtual server is configured with a DNS profile and the Protocol setting is set to TCP...

CVE-2017-6150

Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled default, some specific large fragmented packets may restart the Traffic Management Microkernel TMM...

CVE-2018-5501

In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control...

CVE-2017-6135

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP management port or self IP addresses may lead to out of memory OOM conditions...

CVE-2017-6140

On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 or 12.1.2 of BIG-IP LTM, AAM, AFM, Analytics, ASM, DNS, GTM or PEM, an undisclosed sequence ...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2017-35571)

F5 BIG-IP is a collection of software and hardware that allows you to control the traffic that passes through your network. A denial of service vulnerability exists in F5 BIG-IP. A remote user can cause the target traffic management microkernel TMM to reboot by sending specially crafted TCP traff...

CVE-2017-6159

F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TC...

CVE-2017-6163

In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initiates a number of concurrent streams...

CVE-2017-6144

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

CVE-2017-0305

F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the system when deployed using the Explicit Proxy feature...

F5 BIG-IP Information Disclosure Vulnerability

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP versions 12.0.0 and 11.5.0 through 11.6.1 where a REST request timeout...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

Multiple F5 BIG-IP Product Denial of Service Vulnerabilities (CNVD-2017-00401)

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A denial of service vulnerability exists in multiple F5 BIG-IP products. An attacker could exploit the vulnerabilities to interrup...

F5 Vulnerabilities in the BIG-IP LTM System

F5 BIG-IP LTM is a local traffic manager from F5 USA. A security vulnerability exists in the F5 BIG-IP LTM system. A remote attacker could exploit this vulnerability to modify or extract system configuration files...

Remote Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-07035)

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A remote denial of service vulnerability exists in multiple F5 BIG-IP products, which can be exploited by an attacker to cause a...

Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-03941)

F5 BIG-IP Analytics and others are products of F5 Corporation in the U.S. F5 BIG-IP Analytics is a suite of Web application performance analytics software. the APM is a suite of solutions that provide secure and unified access to business-critical applications and networks. and the LTM is a local...

F5 BigIP 10.2.4 Build 595.0 HF3 Path Traversal

Exploit Title: F5 BigIP File Path Traversal Vulnerability Discovered by: Karn Ganeshen Reported on: April 27, 2015 New version released on: September 01, 2015 Vendor Homepage: www.f5.com Version Reported: F5 BIG-IP 10.2.4 Build 595.0 Hotfix HF3 CVE-2015-4040...

F5 BIG-IP FastL4 Virtual Server Message Handling Denial of Service Vulnerability

F5 BIG-IP APM is a globally unified access and security solution for business-critical applications and networks. A security vulnerability exists in F5 BIG-IP that allows a remote attacker to exploit the vulnerability to submit a special fragmentation message that causes the TMM to reboot,...

F5 BigIP HTTP Virtual Server Scanner

This module scans for BigIP HTTP virtual servers using banner grabbing. BigIP system uses different HTTP profiles for managing HTTP traffic and these profiles allow to customize the string used as Server HTTP header. The default values are "BigIP" or "BIG-IP" depending on the BigIP system version...

F5 Networks Devices Management Interface Scanner

This module attempts to identify the web management interfaces of the following F5 Networks devices: BigIP, BigIQ, Enterprise Manager, ARX, and FirePass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...