Design/Logic Flaw

The Traffic Management Microkernel TMM in F5 BIG-IP LTM, APM, ASM, Edge Gateway, GTM, Link Controller, and WOM 10.0.0 through 10.2.2 and 11.0.0; Analytics 11.0.0; PSM 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.4.1; and WebAccelerator 9.4.0 through 9.4.8, 10.0.0 through...

CVE-2013-6016

The Traffic Management Microkernel TMM in F5 BIG-IP LTM, APM, ASM, Edge Gateway, GTM, Link Controller, and WOM 10.0.0 through 10.2.2 and 11.0.0; Analytics 11.0.0; PSM 9.4.0 through 9.4.8, 10.0.0 through 10.2.4, and 11.0.0 through 11.4.1; and WebAccelerator 9.4.0 through 9.4.8, 10.0.0 through...

CVE-2013-6016

CVE-2013-6016 affects the Traffic Management Microkernel (TMM) in multiple BIG-IP components. The issue may cause a TCP connection to transition to ESTABLISHED before the ACK, allowing remote attackers to trigger a denial of service (SIGFPE or assertion failure) and TMM restart. Affected products...

SOL14740 - OpenSSH vulnerability CVE-2011-5000

Recommended action F5 recommends that you only allow SSH access to the administrative port from a secure network. Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of...

SOL14739 - OpenSSH vulnerability CVE-2008-3234

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

SOL14741 - OpenSSH vulnerability CVE-2010-5107

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL14742 - OpenSSH vulnerability CVE-2008-4109

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

SOL14734 - Apache HTTP server vulnerability CVE-2013-2249

Recommended Action To mitigate this vulnerability for ARX, do not enable the API functionality. Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security...

CVE-2013-5976

Cross-site scripting XSS vulnerability in the access policy logout page logout.inc in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 through 11.3.0 allows remote attackers to inject arbitrary web script or HTML via the LastMRHSession cookie...

CVE-2013-5975

The access policy logon page logon.inc in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the access policy logout page logout.inc in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 through 11.3.0 allows remote attackers to inject arbitrary web script or HTML via the LastMRHSession cookie...

Code injection

The access policy logon page logon.inc in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2013-5976

The CVE-2013-5976 XSS vulnerability affects F5 BIG-IP APM: the access policy logout page (logout.inc) accepts the LastMRH_Session cookie to inject arbitrary script/HTML. Affected versions: BIG-IP APM 10.1.0–10.2.4 and 11.1.0–11.3.0. The security advisory (K14712) notes the vulnerability in the lo...

CVE-2013-5975

The CVE-2013-5975 issue concerns the Access Policy Manager logon.inc page in F5 BIG-IP APM, where 11.1.0–11.2.1 are vulnerable to clickjacking via unspecified vectors. The associated advisory (K14700) confirms vulnerable APM 11.1.0–11.2.1 and notes that the vulnerability was addressed in BIG-IP A...

CVE-2013-5975

The access policy logon page logon.inc in F5 BIG-IP APM 11.1.0 through 11.2.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2013-5976

Cross-site scripting XSS vulnerability in the access policy logout page logout.inc in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 through 11.3.0 allows remote attackers to inject arbitrary web script or HTML via the LastMRHSession cookie...

SOL14712 - The BIG-IP APM access policy logout page may be vulnerable to XSS cookie tampering

Recommended action To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column in the previous table. To mitigate this vulnerability, you can modify the logout web page to null the specific code identified at issue. To do so, perform the...

SOL14700 - BIG-IP APM clickjacking vulnerability

Note: This issue has been addressed in BIG-IP APM 11.3.0 and later through the use of the x-frame-options header in the Access Policy pages. Modifying a BIG-IP APM 11.3.0 or later system dB variable settings for apm.xframeoptions or apm.xframeoptions.allowfrom from their defaults may open the...

SOL14634 - SSL/TLS BREACH vulnerability CVE-2013-3587

Vulnerability Recommended Actions To mitigate this vulnerability, you can disable HTTP compression, or only enable HTTP compression for static content. For information about configuring HTTP compression, refer to the product guides for your specific product and version. Impact of action: Slower...

SOL14613 - BIND vulnerability CVE-2013-4854

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...