CVE-2019-6642
First published: Mon Jul 01 2019(Updated: )
In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 BIG-IP Access Policy Manager | >=11.5.2<=11.6.4 | |
| F5 BIG-IP Access Policy Manager | >=12.1.0<=12.1.4.2 | |
| F5 BIG-IP Access Policy Manager | >=13.0.0<=13.1.1.5 | |
| F5 BIG-IP Access Policy Manager | >=14.0.0<=14.1.0.5 | |
| F5 BIG-IP Access Policy Manager | =15.0.0 | |
| F5 BIG-IP Advanced Firewall Manager | >=11.5.2<=11.6.4 | |
| F5 BIG-IP Advanced Firewall Manager | >=12.1.0<=12.1.4.2 | |
| F5 BIG-IP Advanced Firewall Manager | >=13.0.0<=13.1.1.5 | |
| F5 BIG-IP Advanced Firewall Manager | >=14.0.0<=14.1.0.5 | |
| F5 BIG-IP Advanced Firewall Manager | =15.0.0 | |
| F5 Big-ip Application Acceleration Manager | >=11.5.2<=11.6.4 | |
| F5 Big-ip Application Acceleration Manager | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Application Acceleration Manager | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Application Acceleration Manager | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Application Acceleration Manager | =15.0.0 | |
| F5 Big-ip Link Controller | >=11.5.2<=11.6.4 | |
| F5 Big-ip Link Controller | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Link Controller | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Link Controller | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Link Controller | =15.0.0 | |
| F5 Big-ip Policy Enforcement Manager | >=11.5.2<=11.6.4 | |
| F5 Big-ip Policy Enforcement Manager | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Policy Enforcement Manager | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Policy Enforcement Manager | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Policy Enforcement Manager | =15.0.0 | |
| F5 Big-ip Webaccelerator | >=11.5.2<=11.6.4 | |
| F5 Big-ip Webaccelerator | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Webaccelerator | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Webaccelerator | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Webaccelerator | =15.0.0 | |
| F5 BIG-IP Application Security Manager | >=11.5.2<=11.6.4 | |
| F5 BIG-IP Application Security Manager | >=12.1.0<=12.1.4.2 | |
| F5 BIG-IP Application Security Manager | >=13.0.0<=13.1.1.5 | |
| F5 BIG-IP Application Security Manager | >=14.0.0<=14.1.0.5 | |
| F5 BIG-IP Application Security Manager | =15.0.0 | |
| F5 Big-ip Local Traffic Manager | >=11.5.2<=11.6.4 | |
| F5 Big-ip Local Traffic Manager | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Local Traffic Manager | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Local Traffic Manager | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Local Traffic Manager | =15.0.0 | |
| F5 Big-ip Fraud Protection Service | >=11.5.2<=11.6.4 | |
| F5 Big-ip Fraud Protection Service | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Fraud Protection Service | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Fraud Protection Service | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Fraud Protection Service | =15.0.0 | |
| F5 Big-ip Global Traffic Manager | >=11.5.2<=11.6.4 | |
| F5 Big-ip Global Traffic Manager | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Global Traffic Manager | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Global Traffic Manager | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Global Traffic Manager | =15.0.0 | |
| F5 BIG-IP Analytics | >=11.5.2<=11.6.4 | |
| F5 BIG-IP Analytics | >=12.1.0<=12.1.4.2 | |
| F5 BIG-IP Analytics | >=13.0.0<=13.1.1.5 | |
| F5 BIG-IP Analytics | >=14.0.0<=14.1.0.5 | |
| F5 BIG-IP Analytics | =15.0.0 | |
| F5 Big-ip Edge Gateway | >=11.5.2<=11.6.4 | |
| F5 Big-ip Edge Gateway | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Edge Gateway | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Edge Gateway | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Edge Gateway | =15.0.0 | |
| F5 Big-ip Domain Name System | >=11.5.2<=11.6.4 | |
| F5 Big-ip Domain Name System | >=12.1.0<=12.1.4.2 | |
| F5 Big-ip Domain Name System | >=13.0.0<=13.1.1.5 | |
| F5 Big-ip Domain Name System | >=14.0.0<=14.1.0.5 | |
| F5 Big-ip Domain Name System | =15.0.0 | |
| F5 BIG-IQ Centralized Management | >=5.1.0<=5.4.0 | |
| F5 BIG-IQ Centralized Management | >=6.0.0<=6.1.0 | |
| F5 Enterprise Manager | =3.1.1 | |
| F5 iWorkflow | =2.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/f5
- canonical/f5 big-ip access policy manager
- version/f5 big-ip access policy manager/11.5.2
- version/f5 big-ip access policy manager/11.6.4
- version/f5 big-ip access policy manager/12.1.0
- version/f5 big-ip access policy manager/12.1.4.2
- version/f5 big-ip access policy manager/13.0.0
- version/f5 big-ip access policy manager/13.1.1.5
- version/f5 big-ip access policy manager/14.0.0
- version/f5 big-ip access policy manager/14.1.0.5
- version/f5 big-ip access policy manager/15.0.0
- canonical/f5 big-ip advanced firewall manager
- version/f5 big-ip advanced firewall manager/11.5.2
- version/f5 big-ip advanced firewall manager/11.6.4
- version/f5 big-ip advanced firewall manager/12.1.0
- version/f5 big-ip advanced firewall manager/12.1.4.2
- version/f5 big-ip advanced firewall manager/13.0.0
- version/f5 big-ip advanced firewall manager/13.1.1.5
- version/f5 big-ip advanced firewall manager/14.0.0
- version/f5 big-ip advanced firewall manager/14.1.0.5
- version/f5 big-ip advanced firewall manager/15.0.0
- canonical/f5 big-ip application acceleration manager
- version/f5 big-ip application acceleration manager/11.5.2
- version/f5 big-ip application acceleration manager/11.6.4
- version/f5 big-ip application acceleration manager/12.1.0
- version/f5 big-ip application acceleration manager/12.1.4.2
- version/f5 big-ip application acceleration manager/13.0.0
- version/f5 big-ip application acceleration manager/13.1.1.5
- version/f5 big-ip application acceleration manager/14.0.0
- version/f5 big-ip application acceleration manager/14.1.0.5
- version/f5 big-ip application acceleration manager/15.0.0
- canonical/f5 big-ip link controller
- version/f5 big-ip link controller/11.5.2
- version/f5 big-ip link controller/11.6.4
- version/f5 big-ip link controller/12.1.0
- version/f5 big-ip link controller/12.1.4.2
- version/f5 big-ip link controller/13.0.0
- version/f5 big-ip link controller/13.1.1.5
- version/f5 big-ip link controller/14.0.0
- version/f5 big-ip link controller/14.1.0.5
- version/f5 big-ip link controller/15.0.0
- canonical/f5 big-ip policy enforcement manager
- version/f5 big-ip policy enforcement manager/11.5.2
- version/f5 big-ip policy enforcement manager/11.6.4
- version/f5 big-ip policy enforcement manager/12.1.0
- version/f5 big-ip policy enforcement manager/12.1.4.2
- version/f5 big-ip policy enforcement manager/13.0.0
- version/f5 big-ip policy enforcement manager/13.1.1.5
- version/f5 big-ip policy enforcement manager/14.0.0
- version/f5 big-ip policy enforcement manager/14.1.0.5
- version/f5 big-ip policy enforcement manager/15.0.0
- canonical/f5 big-ip webaccelerator
- version/f5 big-ip webaccelerator/11.5.2
- version/f5 big-ip webaccelerator/11.6.4
- version/f5 big-ip webaccelerator/12.1.0
- version/f5 big-ip webaccelerator/12.1.4.2
- version/f5 big-ip webaccelerator/13.0.0
- version/f5 big-ip webaccelerator/13.1.1.5
- version/f5 big-ip webaccelerator/14.0.0
- version/f5 big-ip webaccelerator/14.1.0.5
- version/f5 big-ip webaccelerator/15.0.0
- canonical/f5 big-ip application security manager
- version/f5 big-ip application security manager/11.5.2
- version/f5 big-ip application security manager/11.6.4
- version/f5 big-ip application security manager/12.1.0
- version/f5 big-ip application security manager/12.1.4.2
- version/f5 big-ip application security manager/13.0.0
- version/f5 big-ip application security manager/13.1.1.5
- version/f5 big-ip application security manager/14.0.0
- version/f5 big-ip application security manager/14.1.0.5
- version/f5 big-ip application security manager/15.0.0
- canonical/f5 big-ip local traffic manager
- version/f5 big-ip local traffic manager/11.5.2
- version/f5 big-ip local traffic manager/11.6.4
- version/f5 big-ip local traffic manager/12.1.0
- version/f5 big-ip local traffic manager/12.1.4.2
- version/f5 big-ip local traffic manager/13.0.0
- version/f5 big-ip local traffic manager/13.1.1.5
- version/f5 big-ip local traffic manager/14.0.0
- version/f5 big-ip local traffic manager/14.1.0.5
- version/f5 big-ip local traffic manager/15.0.0
- canonical/f5 big-ip fraud protection service
- version/f5 big-ip fraud protection service/11.5.2
- version/f5 big-ip fraud protection service/11.6.4
- version/f5 big-ip fraud protection service/12.1.0
- version/f5 big-ip fraud protection service/12.1.4.2
- version/f5 big-ip fraud protection service/13.0.0
- version/f5 big-ip fraud protection service/13.1.1.5
- version/f5 big-ip fraud protection service/14.0.0
- version/f5 big-ip fraud protection service/14.1.0.5
- version/f5 big-ip fraud protection service/15.0.0
- canonical/f5 big-ip global traffic manager
- version/f5 big-ip global traffic manager/11.5.2
- version/f5 big-ip global traffic manager/11.6.4
- version/f5 big-ip global traffic manager/12.1.0
- version/f5 big-ip global traffic manager/12.1.4.2
- version/f5 big-ip global traffic manager/13.0.0
- version/f5 big-ip global traffic manager/13.1.1.5
- version/f5 big-ip global traffic manager/14.0.0
- version/f5 big-ip global traffic manager/14.1.0.5
- version/f5 big-ip global traffic manager/15.0.0
- canonical/f5 big-ip analytics
- version/f5 big-ip analytics/11.5.2
- version/f5 big-ip analytics/11.6.4
- version/f5 big-ip analytics/12.1.0
- version/f5 big-ip analytics/12.1.4.2
- version/f5 big-ip analytics/13.0.0
- version/f5 big-ip analytics/13.1.1.5
- version/f5 big-ip analytics/14.0.0
- version/f5 big-ip analytics/14.1.0.5
- version/f5 big-ip analytics/15.0.0
- canonical/f5 big-ip edge gateway
- version/f5 big-ip edge gateway/11.5.2
- version/f5 big-ip edge gateway/11.6.4
- version/f5 big-ip edge gateway/12.1.0
- version/f5 big-ip edge gateway/12.1.4.2
- version/f5 big-ip edge gateway/13.0.0
- version/f5 big-ip edge gateway/13.1.1.5
- version/f5 big-ip edge gateway/14.0.0
- version/f5 big-ip edge gateway/14.1.0.5
- version/f5 big-ip edge gateway/15.0.0
- canonical/f5 big-ip domain name system
- version/f5 big-ip domain name system/11.5.2
- version/f5 big-ip domain name system/11.6.4
- version/f5 big-ip domain name system/12.1.0
- version/f5 big-ip domain name system/12.1.4.2
- version/f5 big-ip domain name system/13.0.0
- version/f5 big-ip domain name system/13.1.1.5
- version/f5 big-ip domain name system/14.0.0
- version/f5 big-ip domain name system/14.1.0.5
- version/f5 big-ip domain name system/15.0.0
- canonical/f5 big-iq centralized management
- version/f5 big-iq centralized management/5.1.0
- version/f5 big-iq centralized management/5.4.0
- version/f5 big-iq centralized management/6.0.0
- version/f5 big-iq centralized management/6.1.0
- canonical/f5 enterprise manager
- version/f5 enterprise manager/3.1.1
- canonical/f5 iworkflow
- version/f5 iworkflow/2.3.0