CVSS: 8.1EPSS: 0%CPEs: 104EXPL: 0CVE-2017-6164
https://notcve.org/view.php?id=CVE-2017-6164
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4, in some circumstances, Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator y WebSafe en las versiones de software 13.0.0, de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1 y de la 11.5.0 a la 11.5.5.4, en algunas circunstancias, Traffic Management Microkernel (TMM) no maneja correctamente determinados registros TLS1.2 mal formados, lo que permite a los atacantes remotos causar una denegación de servicio (DoS) o, posiblemente, ejecutar comandos remotos en el sistema BIG-IP. • http://www.securitytracker.com/id/1040054 https://support.f5.com/csp/article/K02714910 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 109EXPL: 0CVE-2017-6161
https://notcve.org/view.php?id=CVE-2017-6161
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator en versiones de software de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1, de la 11.4.0 a la 11.5.4 y en la versión 11.2.1, cuando ConfigSync está configurado, los atacantes en redes adyacentes pueden omitir las protecciones TLS, normalmente utilizadas para cifrar y autenticar conexiones al mcpd. Esta vulnerabilidad podría permitir que atacantes remotos provoquen un ataque de denegación de servicio (DoS) mediante el agotamiento de recursos. • http://www.securityfocus.com/bid/101636 http://www.securitytracker.com/id/1039675 http://www.securitytracker.com/id/1039676 https://support.f5.com/csp/article/K62279530 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 92EXPL: 0CVE-2017-0303
https://notcve.org/view.php?id=CVE-2017-0303
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y Websafe en sus versiones de software 13.0.0, de la 12.0.0 a la 12.1.2 y de la 11.5.1 a la 11.6.1, y bajo ciertas circunstancias, las conexiones gestionadas por un servidor virtual con un perfil SOCKS asociado puede que no se limpien correctamente, pudiendo provocar que se agotan los recursos. Las conexiones se pueden dejar en la tabla de conexiones, pudiendo solo eliminarse reiniciando el TMM. • http://www.securityfocus.com/bid/101612 http://www.securitytracker.com/id/1039674 https://support.f5.com/csp/article/K30201296 • CWE-459: Incomplete Cleanup •
CVSS: 5.9EPSS: 0%CPEs: 43EXPL: 0CVE-2017-6159
https://notcve.org/view.php?id=CVE-2017-6159
F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic. F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe en sus versiones de software de la 12.0.0 a la 12.1.2 y de la 11.6.0 a la 11.6.1 son vulnerables a un ataque de denegación de servicio (DoS) cuando la opción MPTCP está habilitada en un servidor virtual. • http://www.securityfocus.com/bid/101633 http://www.securitytracker.com/id/1039669 https://support.f5.com/csp/article/K10002335 •
CVSS: 5.9EPSS: 0%CPEs: 56EXPL: 0CVE-2017-6163
https://notcve.org/view.php?id=CVE-2017-6163
In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initiates a number of concurrent streams beyond the advertised limit can cause a disruption of service. Remote client initiating stream beyond the advertised limit can cause a disruption of service. The Traffic Management Microkernel (TMM) data plane is exposed to this issue; the control plane is not exposed. En F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM en versiones de software de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1 y de la 11.4.0 a la 11.5.4, cuando un servidor virtual utiliza la configuración estándar de los perfiles SPDY o HTTP/2 con un perfil Client SSL y el cliente inicia un número de transmisiones concurrentes superior al límite establecido, se puede provocar una interrupción del servicio. El cliente remoto que inicia una transmisión más allá del límite establecido puede provocar una interrupción del servicio. • http://www.securityfocus.com/bid/101606 http://www.securitytracker.com/id/1039671 https://support.f5.com/csp/article/K22541983 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •