F5 NGINX Controller Information Disclosure Vulnerability (CNVD-2020-33346)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions prior to 3.3.0 that originates when NGINX Controlle...

PT-2020-05: Cross-site scripting (XSS) in F5 Traffic Management User Interface (TMUI)

The vulnerability allows remote attackers to execute malicious JavaScript code in the context of the current user. If the logged-on user has administrative rights and Advanced Shell bash access, an attacker who successfully exploited the vulnerability could fully compromise the BIG-IP system...

PT-2020-04: Arbitrary code execution in F5 Traffic Management User Interface (TMUI)

The vulnerability allows unauthorized remote attackers to execute malicious code on the system, obtain sensitive information, or hijack traffic, as well as use the server with the Traffic Management User Interface TMUI for attacks on other internal resources of the target organization. Advisory...

F5 BIG-IP and BIG-IQ Encryption Issues Vulnerability

F5 BIG-IP and F5 BIG-IQ are both products of F5 Corporation, U.S.A. F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IQ is a software-based cloud management solution. The solution supports the...

F5 Networks BIG-IP : ImageMagick vulnerability (K03512441)

ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c. CVE-2019-13136 Impact BIG-IP AAM,Edge Gateway, WebAccelerator This issue affects BIG-IP systems only when WAM or AAM is provisioned.If exploited, this vulnerability may result ...

F5 Networks BIG-IP : ImageMagick vulnerability (K20336394)

ImageMagick before 7.0.8-50 has a 'use of uninitialized value' vulnerability in the function ReadCUTImage in coders/cut.c. CVE-2019-13135 Impact BIG-IP AAM,Edge Gateway, and WebAccelerator This issue affects BIG-IP systems only when WAM or AAM is provisioned. If exploited, this vulnerabilitymay...

F5 BIG-IP Buffer Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 12.1.0 through 12.1.5. An attacker can exploit the vulnerability to caus...

F5 BIG-IP Input Validation Error Vulnerability (CNVD-2020-24027)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP versions 15.1.0 through 15.1.0.1, 15.0.0 through 15.0.1.1, and 14.1.0 through...

F5 Networks BIG-IP : BIG-IP APM Portal Access vulnerability (K73183618)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.2 / 12.1.5.2 / 14.1.2.5 / 15.0.1.3 / 15.1.0.2 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K73183618 advisory. InBIG-IP APM Portal Access, HTTP pages that are served by back-end serve...

F5 BIG-IP Input Validation Error Vulnerability (CNVD-2020-24028)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in F5 BIG-IP. An attacker could exploit the vulnerability to cause a denial of service...

CVE-2020-5862

On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider...

F5 Networks BIG-IP : BIG-IP HTTP profile vulnerability (K70275209)

Undisclosed HTTP behavior may lead to a denial of service. CVE-2020-5857 Impact This vulnerability impacts the BIG-IP data plane virtual servers with HTTP profiles. A BIG-IP module that has a virtual server with an associated HTTP profile and is processing traffic is impacted. C Tenable Network...

F5 Networks BIG-IP : BIG-IP HTTP/3 QUIC vulnerability (K61367237)

Specially formatted HTTP/3 messages may cause the Traffic Management Microkernel TMM to produce a core file. CVE-2020-5859 Impact TMM may restart and temporarily fail to process traffic on BIG-IP hosts with the HTTP/3 QUIC profile configured. High availability HA configurations will fail over the...

F5 Networks BIG-IP : BIG-IP AWS vulnerability (K01054113)

Under certain conditions, while sending traffic, the Traffic Management Microkernel TMM may produce a core file or stop processing new traffic with the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver on Amazon Web Services AWS systems.CVE-2020-5862 Impact A remote attacker may ...

F5 Networks BIG-IP : BIG-IP TMM Ram Cache vulnerability (K22113131)

The TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors. RAM Cache is a BIG-IP feature used to accelerate HTTP traffic and can be enabled in a Web Acceleration profile. CVE-2020-5861 Impact The BIG-IP system temporarily fai...

F5 Networks BIG-IP : BIG-IP tmsh vulnerability (K36814487)

Users with non-administrator roles for example, Guest or Resource Administratorwith TMOS Shell tmsh access can run arbitrary commands with elevated privilege using a crafted tmsh command.CVE-2020-5858 Impact BIG-IP andBIG-IQ This vulnerability allows unauthorized privileges to authenticated...

F5 Networks BIG-IP : systemd vulnerabilities (K06044762)

CVE-2018-16864 An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his...

Node.js: Malformed HTTP/2 SETTINGS frame leads to reachable assert

I do not expect any form of cash bounty for this issue. If we have discovered a unique vulnerability I only ask that Jordan Zebor and Adam Cabrey of F5 Networks be crediting with finding the issue. Summary: A reachable assert in the NodeJS HTTP/2 implementation can result in a denial of service...

F5 Networks BIG-IP : OpenSSH vulnerability (K64292204)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0-14.1.2. It is, therefore, affected by a vulnerability as referenced in the K64292204 advisory. - sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, whic...

F5 Networks BIG-IP : BIND vulnerability (K15840535)

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to...