CVE-2015-8098
CriticalSummary
F5 BIG-IP APM versions 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 contain a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile.
Risk Assessment
This vulnerability could lead to significant disruptions in system operations and allow attackers to gain control over the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update F5 BIG-IP APM to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in F5 BIG-IP APM
See all- CVE-2017-6129High
In F5 BIG-IP APM software versions 13.0.0 and 12.1.2, under certain circumstances, tunneled VPN flows can lead to a VPN/PPP connflow being prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion.
- CVE-2017-0301High
In F5 BIG-IP APM software versions 11.5.0 to 12.1.2, there is an issue where BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources.
- CVE-2022-29263High
F5 BIG-IP APM and APM Clients have a vulnerability related to improper handling of temporary files by the Edge Client Component Installer Service. Affected versions include 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13.1.x before 13.1.5, all 12.1.x and 11.6.x, and APM Clients 7.x before 7.2.1.5.
Original NVD description (English source)
F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile, aka an "Out-of-bounds memory vulnerability."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS