CVE-2017-6138
HighSummary
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings.
Risk Assessment
An attacker could exploit this vulnerability to disrupt the operation of virtual servers, potentially leading to service availability interruptions. This poses a risk to the organization's operational continuity and reputation.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability. Additionally, consider reviewing the configuration of APM profiles and the 'normalize URI' options used in iRules and/or BIG-IP LTM policies.
Other vulnerabilities in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe
See all- CVE-2017-6135High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe software version 13.0.0, a slow memory leak due to undisclosed IPv4 or IPv6 packets sent to the BIG-IP management port or self IP addresses may lead to out of memory (OOM) conditions.
- CVE-2017-6132High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software versions 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 to 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners (primary and/or secondary IP) may cause TMM to restart.
- CVE-2017-6157High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and Websafe software versions 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, and 11.5.0 - 11.5.4, there is a vulnerability that allows an unauthenticated remote attack. An attacker can modify the BIG-IP system configuration, extract sensitive system files, and potentially execute remote commands on the BIG-IP system.
- CVE-2017-0303High
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software versions 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation.
- CVE-2017-6165Critical
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe versions from 11.5.1 HF6 to 12.1.2 on VIPRION platforms, the script synchronizing SafeNet HSM configuration between blades in a clustered deployment logs the HSM partition password in cleartext to the '/var/log/ltm' log file.
Original NVD description (English source)
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies.