PT-2017-16911 · F5 · F5 Big-Ip Apm

Published 2017-12-21 · Updated 2019-04-12 · CVE-2017-6139

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM software versions 12.1.2 and 13.0.0

Description The issue occurs under rare conditions where the BIG-IP APM system appends log details when responding to client requests. The details in the log file can vary. Customers running debug mode logging with BIG-IP APM are at the highest risk.

Recommendations For version 12.1.2, consider disabling debug mode logging to minimize the risk of exploitation. For version 13.0.0, consider disabling debug mode logging to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2017-6139

Affected Products

F5 Big-Ip Apm

References · 5

• https://support.f5.com/csp/article/K45432295 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6139 · Security Note
• http://securityfocus.com/bid/106186 · Note
• http://securitytracker.com/id/1040055 · Note