CVE-2019-6603: High severity f5 access policy manager vulnerability

Q: What is the severity of CVE-2019-6603?

CVE-2019-6603 has been classified as a medium severity vulnerability impacting certain versions of F5 BIG-IP products.

Q: How do I fix CVE-2019-6603?

To mitigate CVE-2019-6603, update your F5 BIG-IP product to a version above 11.5.8, 11.6.3, 12.1.3, or 13.0.1.

Q: What products are affected by CVE-2019-6603?

CVE-2019-6603 affects multiple F5 BIG-IP products including Access Policy Manager, Advanced Firewall Manager, and Application Security Manager.

Q: What type of attack does CVE-2019-6603 protect against?

CVE-2019-6603 protects against denial of service attacks caused by malformed TCP packets.

Q: Does CVE-2019-6603 affect the control plane of F5 BIG-IP products?

No, CVE-2019-6603 specifically impacts the data plane virtual servers and self IPs, not the control plane.

Published Mar 28, 2019

Updated

In BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, and 13.0.0-13.0.1, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause an interruption of service. The control plane is not exposed to this issue. This issue impacts the data plane virtual servers and self IPs.

Affected Software

52 affected components

F5 BIG-IP Access Policy Manager>=11.5.1<=11.5.8

F5 BIG-IP Access Policy Manager>=11.6.1<=11.6.3

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3

F5 BIG-IP Access Policy Manager>=13.0.0<=13.0.1

F5 BIG-IP Advanced Firewall Manager>=11.5.1<=11.5.8

F5 BIG-IP Advanced Firewall Manager>=11.6.1<=11.6.3

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3

F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.0.1

F5 Big-ip Application Acceleration Manager>=11.5.1<=11.5.8

F5 Big-ip Application Acceleration Manager>=11.6.1<=11.6.3

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3

F5 Big-ip Application Acceleration Manager>=13.0.0<=13.0.1

F5 BIG-IP Edge Gateway>=11.5.1<=11.5.8

F5 BIG-IP Edge Gateway>=11.6.1<=11.6.3

F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3

F5 BIG-IP Edge Gateway>=13.0.0<=13.0.1

F5 Big-ip Fraud Protection Service>=11.5.1<=11.5.8

F5 Big-ip Fraud Protection Service>=11.6.1<=11.6.3

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.3

F5 Big-ip Fraud Protection Service>=13.0.0<=13.0.1

F5 Big-ip Global Traffic Manager>=11.5.1<=11.5.8

F5 Big-ip Global Traffic Manager>=11.6.1<=11.6.3

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3

F5 Big-ip Global Traffic Manager>=13.0.0<=13.0.1

F5 Big-ip Link Controller>=11.5.1<=11.5.8

F5 Big-ip Link Controller>=11.6.1<=11.6.3

F5 Big-ip Link Controller>=12.1.0<=12.1.3

F5 Big-ip Link Controller>=13.0.0<=13.0.1

F5 Big-ip Local Traffic Manager>=11.5.1<=11.5.8

F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.3

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3

F5 Big-ip Local Traffic Manager>=13.0.0<=13.0.1

F5 Big-ip Policy Enforcement Manager>=11.5.1<=11.5.8

F5 Big-ip Policy Enforcement Manager>=11.6.1<=11.6.3

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3

F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.0.1

F5 Big-ip Protocol Security Manager>=11.5.1<=11.5.8

F5 Big-ip Protocol Security Manager>=11.6.1<=11.6.3

F5 Big-ip Protocol Security Manager>=12.1.0<=12.1.3

F5 Big-ip Protocol Security Manager>=13.0.0<=13.0.1

F5 Big-ip Webaccelerator>=11.5.1<=11.5.8

F5 Big-ip Webaccelerator>=11.6.1<=11.6.3

F5 Big-ip Webaccelerator>=12.0.0<=12.1.3

F5 Big-ip Webaccelerator>=13.0.0<=13.0.1

F5 BIG-IP Analytics>=11.5.1<=11.5.8

F5 BIG-IP Analytics>=11.6.1<=11.6.3

F5 BIG-IP Analytics>=12.1.0<=12.1.3

F5 BIG-IP Analytics>=13.0.0<=13.0.1

F5 BIG-IP Application Security Manager>=11.5.1<=11.5.8

F5 BIG-IP Application Security Manager>=11.6.1<=11.6.3

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3

F5 BIG-IP Application Security Manager>=13.0.0<=13.0.1

Event History

Mar 28, 2019

CVE Published

via MITRE·08:13 PM

Data Sourced

via MITRE·08:13 PM

DescriptionWeakness

Data Sourced

via NVD·09:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-6603?

CVE-2019-6603 has been classified as a medium severity vulnerability impacting certain versions of F5 BIG-IP products.

How do I fix CVE-2019-6603?

To mitigate CVE-2019-6603, update your F5 BIG-IP product to a version above 11.5.8, 11.6.3, 12.1.3, or 13.0.1.

What products are affected by CVE-2019-6603?

CVE-2019-6603 affects multiple F5 BIG-IP products including Access Policy Manager, Advanced Firewall Manager, and Application Security Manager.

What type of attack does CVE-2019-6603 protect against?

CVE-2019-6603 protects against denial of service attacks caused by malformed TCP packets.

Does CVE-2019-6603 affect the control plane of F5 BIG-IP products?