PT-2019-18185 · F5 · F5 Big-Ip

Published 2019-03-28 · Updated 2020-08-24 · CVE-2019-6603

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.1 through 11.5.8 F5 BIG-IP versions 11.6.1 through 11.6.3 F5 BIG-IP versions 12.1.0 through 12.1.3 F5 BIG-IP versions 13.0.0 through 13.0.1

Description The issue is caused by malformed TCP packets sent to a self IP address or a FastL4 virtual server, which may result in an interruption of service. This issue affects the data plane virtual servers and self IPs, but the control plane is not exposed.

Recommendations For versions 11.5.1 through 11.5.8, update to a version outside of this range to resolve the issue. For versions 11.6.1 through 11.6.3, update to a version outside of this range to resolve the issue. For versions 12.1.0 through 12.1.3, update to a version outside of this range to resolve the issue. For versions 13.0.0 through 13.0.1, update to a version outside of this range to resolve the issue.

Fix

Related Identifiers

CVE-2019-6603

Affected Products

F5 Big-Ip

References · 4

• https://osv.dev/vulnerability/CVE-2019-6603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6603 · Security Note
• https://support.f5.com/csp/article/K14632915 · Vendor Advisory
• http://securityfocus.com/bid/107625 · Note