CVSS: 6.5EPSS: 0%CPEs: 33EXPL: 0CVE-2017-6134
https://notcve.org/view.php?id=CVE-2017-6134
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y WebSafe, en versiones de software 13.0.0, de la 12.1.0 a la 12.1.2 y de la 11.5.1 a la 11.6.1, una secuencia de paquetes no revelada cuyo origen es una red adyacente podría hacer que TMM se cierre de manera inesperada. • http://www.securityfocus.com/bid/102466 http://www.securitytracker.com/id/1040044 http://www.securitytracker.com/id/1040045 https://support.f5.com/csp/article/K37404773 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2017-6138
https://notcve.org/view.php?id=CVE-2017-6138
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y WebSafe, en versiones de software 13.0.0 y de la 12.1.0 a la 12.1.2, las peticiones maliciosas enviadas al servidor virtual con un perfil HTTP puede provocar que el TMM se reinicie. El problema está presente en perfiles BIG-IP APM, independientemente de su configuración. • http://www.securitytracker.com/id/1040051 https://support.f5.com/csp/article/K34514540 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 104EXPL: 0CVE-2017-6164
https://notcve.org/view.php?id=CVE-2017-6164
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 - 11.5.4, in some circumstances, Traffic Management Microkernel (TMM) does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service (DoS) or possible remote command execution on the BIG-IP system. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator y WebSafe en las versiones de software 13.0.0, de la 12.0.0 a la 12.1.2, de la 11.6.0 a la 11.6.1 y de la 11.5.0 a la 11.5.5.4, en algunas circunstancias, Traffic Management Microkernel (TMM) no maneja correctamente determinados registros TLS1.2 mal formados, lo que permite a los atacantes remotos causar una denegación de servicio (DoS) o, posiblemente, ejecutar comandos remotos en el sistema BIG-IP. • http://www.securitytracker.com/id/1040054 https://support.f5.com/csp/article/K02714910 • CWE-20: Improper Input Validation •
CVSS: 8.5EPSS: 0%CPEs: 20EXPL: 0CVE-2017-6167
https://notcve.org/view.php?id=CVE-2017-6167
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe, en versiones 13.0.0 y de la 12.1.0 a la 12.1.2, las condiciones de carrera en iControl REST pueden conducir a la ejecución de comandos con niveles de privilegios diferentes a los esperados. • http://www.securitytracker.com/id/1040053 https://support.f5.com/csp/article/K24465120 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 0%CPEs: 92EXPL: 0CVE-2017-0303
https://notcve.org/view.php?id=CVE-2017-0303
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y Websafe en sus versiones de software 13.0.0, de la 12.0.0 a la 12.1.2 y de la 11.5.1 a la 11.6.1, y bajo ciertas circunstancias, las conexiones gestionadas por un servidor virtual con un perfil SOCKS asociado puede que no se limpien correctamente, pudiendo provocar que se agotan los recursos. Las conexiones se pueden dejar en la tabla de conexiones, pudiendo solo eliminarse reiniciando el TMM. • http://www.securityfocus.com/bid/101612 http://www.securitytracker.com/id/1039674 https://support.f5.com/csp/article/K30201296 • CWE-459: Incomplete Cleanup •