NetSight
IP …
medium6.5

CVE-2019-6634

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in re…

Impact

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in restjavad process. This causes issues with both iControl REST and some portions of TMUI. The attack requires an authenticated user with any role.

Affected products

VendorProductAffected versions
F5Big-Ip Local Traffic Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Application Acceleration Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Advanced Firewall Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Analytics
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Access Policy Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Application Security Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Domain Name System
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Edge Gateway
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Global Traffic Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Link Controller
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Policy Enforcement Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Webaccelerator
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6

References