NetSight
IP …
high8.8

CVE-2019-6642

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Man…

Impact

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

Affected products

VendorProductAffected versions
F5Big-Ip Access Policy Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Advanced Firewall Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Application Acceleration Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Link Controller
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Policy Enforcement Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Webaccelerator
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Application Security Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Local Traffic Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Fraud Protection Service
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Global Traffic Manager
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Analytics
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0
F5Big-Ip Edge Gateway
from 11.5.2 through 11.6.4
from 12.1.0 through 12.1.4.2
from 13.0.0 through 13.1.1.5
from 14.0.0 through 14.1.0.5
Version 15.0.0

References