F5 Networks BIG-IP : Slowloris denial-of-service attack vulnerability (K12636)

The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service daemon outage via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the modreqtimeout module in versions before 2.2.15. CVE-2007-6750 Impact The Slowloris attack is a type of...

F5 Networks BIG-IP : iControl vulnerability (K47284724)

Permissions enforced by iControl can lag behind the actual permissions assigned to a user if the rolemap is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which...

F5 Networks BIG-IP : TMM vulnerability (K22216037)

Malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default 'Normalize URI' configuration options used in iRules and/or BIG-IP LTM policies...

F5 Networks BIG-IP : OpenSSL vulnerability (K37526132)

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; user...

F5 Networks BIG-IP : libarchive vulnerability (K13074505)

Stack-based buffer overflow in the safefprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename. CVE-2016-8687 C Tenable Network Security, Inc. The descriptive text and package checks in...

F5 Networks BIG-IP : libarchive vulnerability (K35263486)

The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service crash via a crafted file, which triggers an invalid read in the 1 detectform or 2 bidentry function in...

F5 Networks BIG-IP : libarchive vulnerability (K52697522)

The readHeader function in archivereadsupportformat7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service out-of-bounds read via multiple EmptyStream attributes in a header in a 7zip archive. CVE-2016-8689 C Tenable Network Security, Inc. The descriptive text and package...

F5 Networks BIG-IP : BIND vulnerability (K80533167)

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 - 9.9.9-S7, 9.9.3 - 9.9.9-P5, 9.9.10b1,...

F5 Networks BIG-IP : Linux privilege-escalation vulnerability (K10558632) (Dirty COW)

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write COW feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka 'Dirty COW.' CVE-2016-5195...

F5 Networks BIG-IP : Linux kernel vulnerability (K17309)

The 1 udprecvmsg and 2 udpv6recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service EPOLLET epoll application read outage via an incorrect checksum in a UDP packet, a different vulnerability than...

F5 Networks BIG-IP : Linux kernel vulnerability (K17307)

The 1 udprecvmsg and 2 udpv6recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service system hang via incorrect checksums within a UDP packet flood. CVE-2015-5364 C Tenable Network Security, Inc. Th...

F5 BIG-IP - REST vulnerability CVE-2016-6249

F5 BIG-IP REST requests which timeout during user account authentication may log sensitive attributes such as password in plaintext to /var/log/restjavad.0.log. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

F5 BIG-IP Information Disclosure Vulnerability

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP versions 12.0.0 and 11.5.0 through 11.6.1 where a REST request timeout...

F5 BIG-IP - OpenSSL vulnerability CVE-2017-3732

Multiple vulnerabilities in OpenSSL affecting F5 Big IP. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if descripti...

Design/Logic Flaw

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

CVE-2016-6249

Summary of CVE-2016-6249 (F5 BIG-IP REST vulnerability) Affected products/versions: F5 BIG-IP 12.0.0 and 11.5.0 – 11.6.1 (REST framework). The vendor advisory lists vulnerable and non‑vulnerable versions (e.g., 12.1.0–12.1.2 as not vulnerable) and enumerates affected modules under the REST framew...

CVE-2016-6249

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files...

F5 Networks BIG-IP : OpenSSL vulnerability (K44512851)

There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed...