CVE-2019-6676: High severity f5 access policy manager vulnerability
Published Dec 23, 2019
·Updated
On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual Edition (VE) when using virtio direct descriptors and packets 2 KB or larger.
Affected Software
39 affected components
F5 BIG-IP Access Policy Manager>=13.1.0<13.1.3.2
F5 BIG-IP Access Policy Manager>=14.0.0<14.1.2.3
F5 BIG-IP Access Policy Manager>=15.0.0<15.0.1.1
F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.3.2
F5 BIG-IP Advanced Firewall Manager>=14.0.0<14.1.2.3
F5 BIG-IP Advanced Firewall Manager>=15.0.0<15.0.1.1
F5 BIG-IP Analytics>=13.1.0<13.1.3.2
F5 BIG-IP Analytics>=14.0.0<14.1.2.3
F5 BIG-IP Analytics>=15.0.0<15.0.1.1
F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.3.2
F5 Big-ip Application Acceleration Manager>=14.0.0<14.1.2.3
F5 Big-ip Application Acceleration Manager>=15.0.0<15.0.1.1
F5 BIG-IP Application Security Manager>=13.1.0<13.1.3.2
F5 BIG-IP Application Security Manager>=14.0.0<14.1.2.3
F5 BIG-IP Application Security Manager>=15.0.0<15.0.1.1
F5 Big-ip Domain Name System>=13.1.0<13.1.3.2
F5 Big-ip Domain Name System>=14.0.0<14.1.2.3
F5 Big-ip Domain Name System>=15.0.0<15.0.1.1
F5 BIG-IP Edge Gateway>=13.1.0<13.1.3.2
F5 BIG-IP Edge Gateway>=14.0.0<14.1.2.3
F5 BIG-IP Edge Gateway>=15.0.0<15.0.1.1
F5 Big-ip Fraud Protection Service>=13.1.0<13.1.3.2
F5 Big-ip Fraud Protection Service>=14.0.0<14.1.2.3
F5 Big-ip Fraud Protection Service>=15.0.0<15.0.1.1
F5 Big-ip Global Traffic Manager>=13.1.0<13.1.3.2
F5 Big-ip Global Traffic Manager>=14.0.0<14.1.2.3
F5 Big-ip Global Traffic Manager>=15.0.0<15.0.1.1
F5 Big-ip Link Controller>=13.1.0<13.1.3.2
F5 Big-ip Link Controller>=14.0.0<14.1.2.3
F5 Big-ip Link Controller>=15.0.0<15.0.1.1
F5 Big-ip Local Traffic Manager>=13.1.0<13.1.3.2
F5 Big-ip Local Traffic Manager>=14.0.0<14.1.2.3
F5 Big-ip Local Traffic Manager>=15.0.0<15.0.1.1
F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.3.2
F5 Big-ip Policy Enforcement Manager>=14.0.0<14.1.2.3
F5 Big-ip Policy Enforcement Manager>=15.0.0<15.0.1.1
F5 Big-ip Webaccelerator>=13.1.0<13.1.3.2
F5 Big-ip Webaccelerator>=14.0.0<14.1.2.3
F5 Big-ip Webaccelerator>=15.0.0<15.0.1.1
Event History
Dec 23, 2019
CVE Published
via MITRE·04:41 PM
Data Sourced
via MITRE·04:41 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2019-6676.
2
What is the severity of CVE-2019-6676?
The severity of CVE-2019-6676 is high (CVSS score: 7.5).
3
Which versions of F5 BIG-IP products are affected by CVE-2019-6676?
Versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1 of F5 BIG-IP products are affected by CVE-2019-6676.
4
What is the impact of CVE-2019-6676?
The impact of CVE-2019-6676 is that TMM (Traffic Management Microkernel) may restart on BIG-IP Virtual Edition (VE) when using virtio direct descriptors and packets 2 KB or larger.
5
Is there a fix available for CVE-2019-6676?
Yes, F5 Networks has released a fix for CVE-2019-6676. Please refer to the vendor's advisory for more information.