Denial of Service Vulnerability in F5 BIG-IP Systems by F5 Networks

CVE-2016-9245

What is CVE-2016-9245?

A vulnerability exists in F5 BIG-IP systems (versions 12.1.0 to 12.1.2) where crafted malicious requests targeting virtual servers with HTTP profiles can trigger a restart of the Traffic Management Microkernel (TMM). This issue is particularly relevant for BIG-IP APM profiles, exposing the system regardless of the configured settings. Additionally, those utilizing the non-default 'Normalize URI' settings in iRules or BIG-IP LTM policies may also find their systems susceptible. An attacker exploiting this vulnerability could disrupt traffic flow or force the BIG-IP to failover to another device within the device group, leading to potential service interruptions.

References