CVSS: 5.9EPSS: 0%CPEs: 43EXPL: 0CVE-2017-6159
https://notcve.org/view.php?id=CVE-2017-6159
27 Oct 2017 — F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic. F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, G... • http://www.securityfocus.com/bid/101633 •
CVSS: 7.5EPSS: 0%CPEs: 92EXPL: 0CVE-2017-0303
https://notcve.org/view.php?id=CVE-2017-0303
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections... • http://www.securityfocus.com/bid/101612 • CWE-459: Incomplete Cleanup •
CVSS: 5.9EPSS: 0%CPEs: 50EXPL: 0CVE-2017-6162
https://notcve.org/view.php?id=CVE-2017-6162
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the... • http://www.securityfocus.com/bid/101635 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 56EXPL: 0CVE-2017-6163
https://notcve.org/view.php?id=CVE-2017-6163
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initiates a number of concurrent streams beyond the advertised limit can cause a disruption of service. Remote client initiating stream beyond the advertised limit can cause a disruption of service. The Traffic Management Microkernel (TMM) data plane is exp... • http://www.securityfocus.com/bid/101606 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 109EXPL: 0CVE-2017-6161
https://notcve.org/view.php?id=CVE-2017-6161
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, A... • http://www.securityfocus.com/bid/101636 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 1%CPEs: 47EXPL: 0CVE-2017-6157
https://notcve.org/view.php?id=CVE-2017-6157
27 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an unauthenticated, remote attack that allows modification of BIG-IP system configuration, extraction of sensitive system files, and/or possible remote command execution on the BIG-IP system. En F5 BIG-IP LTM, AAM, AFM, Analytics,... • http://www.securityfocus.com/bid/101634 •
CVSS: 5.9EPSS: 0%CPEs: 26EXPL: 0CVE-2017-6160
https://notcve.org/view.php?id=CVE-2017-6160
27 Oct 2017 — In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel (TMM) to restart and temporarily fail to process traffic. This issue is exposed on virtual servers using a Policy Enforcement profile or a Web Acceleration profile. Systems that do not have BIG-IP AAM module provisioned are not vulnerable. The Traffic Management Microkernel (TMM) may restart and temporarily fail ... • http://www.securityfocus.com/bid/101632 •
CVSS: 5.9EPSS: 0%CPEs: 24EXPL: 0CVE-2017-6141
https://notcve.org/view.php?id=CVE-2017-6141
20 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel (TMM). The Session Ticket option is disabled by default. En F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM y WebSafe 12.1.0 hasta la 12.1.2, ciertos valores en una negociación abreviada TLS al emplear un perfil de cliente... • https://support.f5.com/csp/article/K21154730 • CWE-20: Improper Input Validation •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6144
https://notcve.org/view.php?id=CVE-2017-6144
20 Oct 2017 — In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in BIG-IP PEM for Device Type and OS (DTOS) and Tethering detection. Customers not using BIG-IP PEM, not configuring downloads of TAC database files, or not using HTTP for that download are not affected. En F5 BIG-IP... • https://support.f5.com/csp/article/K81601350 • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 0%CPEs: 111EXPL: 0CVE-2017-6165
https://notcve.org/view.php?id=CVE-2017-6165
20 Oct 2017 — In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0.0 through 12.1.2 on VIPRION platforms only, the script which synchronizes SafeNet External Network HSM configuration elements between blades in a clustered deployment will log the HSM partition password in cleartext to the "/var/log/ltm" log file. En F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM y WebSafe 11.5.1 HF6 has... • http://www.securityfocus.com/bid/101543 • CWE-532: Insertion of Sensitive Information into Log File •