CVE-2022-35272

CVE-2022-35272 affects BIG-IP HTTP MRF. When source-port preserve-strict is enabled on an MRF virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to crash (core file) and terminate connections, leading to a denial of service. Affected versions: BIG-IP 17.0.x bef...

PT-2022-22676

Name of the Vulnerable Software and Affected Versions BIG-IP versions 16.1.x through 16.1.3.0 BIG-IP versions 17.0.x through 17.0.0.0 Description When source-port preserve-strict is configured on an HTTP Message Routing Framework MRF virtual server, undisclosed traffic may cause the Traffic...

F5 BIG-IP HTTP MRF Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial of service vulnerability exists in the F5 BIG-IP HTTP MRF, which stems from the configuration of source-port preserv...

F5 Networks BIG-IP : BIG-IP HTTP MRF vulnerability (K90024104)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.3.1 / 17.0.0.1 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K90024104 advisory. - In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict ...

CVE-2022-26370

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol SIP message routing framework MRF application layer gateway ALG profile is configured on a Message Routing virtual server, undisclosed request...

Design/Logic Flaw

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol SIP message routing framework MRF application layer gateway ALG profile is configured on a Message Routing virtual server, undisclosed request...

CVE-2022-26370

The CVE-2022-26370 issue affects F5 BIG-IP SIP MRF ALG profile on a Message Routing virtual server. Undisclosed requests can trigger termination of the Traffic Management Microkernel (TMM), causing traffic disruption/DoS as the TMM restarts. Affected versions: BIG-IP 16.1.x before 16.1.2.2, 15.1....

CVE-2022-26370: Use of Uninitialized Resource

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol SIP message routing framework MRF application layer gateway ALG profile is configured on a Message Routing virtual server, undisclosed request...

PT-2022-17818

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 16.1.2.2 F5 BIG-IP versions prior to 15.1.5 F5 BIG-IP versions prior to 14.1.4.6 Description The issue occurs when a Session Initiation Protocol SIP message routing framework MRF application layer gateway ALG profil...

F5 Networks BIG-IP : BIG-IP MRF Diameter vulnerability (K82793463)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5 / 14.1.4.4 / 15.1.4.1 / 16.1.2. It is, therefore, affected by a vulnerability as referenced in the K82793463 advisory. - On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and al...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K81557381)

When the BIG-IP system is configured in HTTP/2 full proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel TMM. CVE-2019-6673 Impact An attacker may be able to use a specifically crafted request to cause a disruption of service...

F5 Networks BIG-IP : BIG-IP MRF Diameter vulnerability (K55812535)

TheTraffic Management Microkernel TMM might stop responding after the total number of diameter connections and pending messages on a single virtual server has reached 32K. CVE-2019-6686 Impact BIG-IP This vulnerability affects only virtual servers associated with the message routing diameter...

gdal/mrf_fuzzer: Heap-buffer-overflow in GDAL_LercNS::Lerc2::ComputeChecksumFletcher32

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5450985903226880 Project: gdal Fuzzer: aflgdalmrffuzzer Fuzz target binary: mrffuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x607000000761 Crash...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

Command injection

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

CVE-2016-10043

Radisys MRF Web Panel (SWMS) 9.0.1 is vulnerable to OS command injection via the MSM_MACRO_NAME POST parameter in /swms/ms.cgi. An attacker can use the pipe character (|) to inject arbitrary commands and retrieve output from responses, enabling possible unauthorized command execution, with risks ...

CVE-2016-10043: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

Radisys MRF - Command Injection

Title: MRF Web Panel OS Command Injection Vendor: Radisys Vendor Homepage: http://www.radisys.com Product: MRF Web Panel SWMS Version: 9.0.1 CVE: CVE-2016-10043 CWE: CWE-78 Risk Level: High Discovery: Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos COSMOTE OTE Group Information & Networ...