Sign-up

ID

VAR-201911-0284


CVE

CVE-2019-6660


TITLE

BIG-IP Vulnerable to resource exhaustion

Trust: 0.8

sources: JVNDB: JVNDB-2019-012041

DESCRIPTION

On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service. BIG-IP Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. Traffic Management Microkernel (TMM) is one of the traffic management components. The TMM in F5 BIG-IP versions 14.1.0 to 14.1.2, 14.0.0 to 14.0.1, and 13.1.0 to 13.1.1 has a security vulnerability

Trust: 1.8

sources: NVD: CVE-2019-6660 // JVNDB: JVNDB-2019-012041 // VULHUB: VHN-158095 // VULMON: CVE-2019-6660

AFFECTED PRODUCTS

vendor:f5model:big-ip local traffic managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:14.1.2.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:14.0.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0.5

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0.2

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0.1

Trust: 0.6

vendor:f5model:big-ip link controllerscope:eqversion:13.1.0.2

Trust: 0.6

vendor:f5model:big-ip link controllerscope:eqversion:13.1.0.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0.6

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.2

Trust: 0.6

vendor:f5model:big-ip link controllerscope:eqversion:13.1.0.0

Trust: 0.6

sources: JVNDB: JVNDB-2019-012041 // CNNVD: CNNVD-201911-1012 // NVD: CVE-2019-6660

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6660
value: HIGH

Trust: 1.0

NVD: CVE-2019-6660
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201911-1012
value: HIGH

Trust: 0.6

VULHUB: VHN-158095
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-6660
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-6660
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-158095
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6660
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2019-6660
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-158095 // VULMON: CVE-2019-6660 // JVNDB: JVNDB-2019-012041 // CNNVD: CNNVD-201911-1012 // NVD: CVE-2019-6660

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.9

sources: VULHUB: VHN-158095 // JVNDB: JVNDB-2019-012041 // NVD: CVE-2019-6660

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1012

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201911-1012

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-012041

PATCH
title:K23860356url:https://support.f5.com/csp/article/K23860356
Trust: 0.8
title:F5 BIG-IP Traffic Management Microkernel Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=108200
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-012041 // 
            
            
            
            CNNVD: CNNVD-201911-1012

EXTERNAL IDS
db:NVDid:CVE-2019-6660
Trust: 2.6
db:JVNDBid:JVNDB-2019-012041
Trust: 0.8
db:CNNVDid:CNNVD-201911-1012
Trust: 0.7
db:AUSCERTid:ESB-2019.4305.2
Trust: 0.6
db:AUSCERTid:ESB-2019.4305
Trust: 0.6
db:VULHUBid:VHN-158095
Trust: 0.1
db:VULMONid:CVE-2019-6660
Trust: 0.1
sources:
            
            
            VULHUB: VHN-158095 // 
            
            
            
            VULMON: CVE-2019-6660 // 
            
            
            
            JVNDB: JVNDB-2019-012041 // 
            
            
            
            CNNVD: CNNVD-201911-1012 // 
            
            
            
            NVD: CVE-2019-6660

REFERENCES
url:https://support.f5.com/csp/article/k23860356
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2019-6660
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6660
Trust: 0.8
url:https://vigilance.fr/vulnerability/f5-big-ip-infinite-loop-via-tmm-http-request-30876
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4305/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4305.2/
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/400.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/171910
Trust: 0.1
sources:
            
            
            VULHUB: VHN-158095 // 
            
            
            
            VULMON: CVE-2019-6660 // 
            
            
            
            JVNDB: JVNDB-2019-012041 // 
            
            
            
            CNNVD: CNNVD-201911-1012 // 
            
            
            
            NVD: CVE-2019-6660

SOURCES
db:VULHUBid:VHN-158095
db:VULMONid:CVE-2019-6660
db:JVNDBid:JVNDB-2019-012041
db:CNNVDid:CNNVD-201911-1012
db:NVDid:CVE-2019-6660

LAST UPDATE DATE
2024-11-23T22:37:36.840000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-158095date:2019-11-19T00:00:00
db:VULMONid:CVE-2019-6660date:2019-11-19T00:00:00
db:JVNDBid:JVNDB-2019-012041date:2019-11-25T00:00:00
db:CNNVDid:CNNVD-201911-1012date:2019-11-25T00:00:00
db:NVDid:CVE-2019-6660date:2024-11-21T04:46:54.230

SOURCES RELEASE DATE
db:VULHUBid:VHN-158095date:2019-11-15T00:00:00
db:VULMONid:CVE-2019-6660date:2019-11-15T00:00:00
db:JVNDBid:JVNDB-2019-012041date:2019-11-25T00:00:00
db:CNNVDid:CNNVD-201911-1012date:2019-11-15T00:00:00
db:NVDid:CVE-2019-6660date:2019-11-15T21:15:11.293