CVE-2017-6129
HighSummary
In F5 BIG-IP APM software versions 13.0.0 and 12.1.2, under certain circumstances, tunneled VPN flows can lead to a VPN/PPP connflow being prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion.
Risk Assessment
An attacker may disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
Recommendation
It is recommended to update the software to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in F5 BIG-IP APM
See all- CVE-2017-0301High
In F5 BIG-IP APM software versions 11.5.0 to 12.1.2, there is an issue where BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources.
- CVE-2015-8098Critical
F5 BIG-IP APM versions 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 contain a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile.
- CVE-2022-29263High
F5 BIG-IP APM and APM Clients have a vulnerability related to improper handling of temporary files by the Edge Client Component Installer Service. Affected versions include 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13.1.x before 13.1.5, all 12.1.x and 11.6.x, and APM Clients 7.x before 7.2.1.5.
Original NVD description (English source)
In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or cause TMM to stop responding with a "flow not in use" assertion. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS