Incorrect Logic Execution in BIG-IP Systems due to PPTP VPN Traffic Processing
CVE-2019-6611

7.5HIGH

Key Information:

Vendor
F5
Status
Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator)
Vendor
CVE Published:
3 May 2019

Summary

The vulnerability in certain versions of F5 BIG-IP systems arises when processing specific rare data sequences in PPTP VPN traffic. This anomaly can lead to incorrect logic execution, potentially causing the Traffic Management Microkernel (TMM) to restart unexpectedly and create a core file. Systems provisioned with the Carrier Grade NAT (CGNAT) module and configured with a PPTP profile are particularly susceptible to this issue.

Affected Version(s)

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 14.0.0-14.1.0.1

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 13.0.0-13.1.1.4

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) 12.1.0-12.1.4

References

https://support.f5.com/csp/article/K47527163
x_refsource_CONFIRM
http://www.securityfocus.com/bid/108187
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.