ID

VAR-201911-0287


CVE

CVE-2019-6663


TITLE

plural F5 Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-012043

DESCRIPTION

The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack. plural F5 The product contains an input validation vulnerability.Information may be tampered with. F5 BIG-IP and so on are all products of F5 Company in the United States. F5 BIG-IP is an application delivery platform that integrates functions such as network traffic management, application security management, and load balancing. F5 Enterprise Manager is a tool that provides visibility into the entire BIG-IP application delivery infrastructure and optimizes application performance. F5 BIG-IQ Centralized Management is a software-based cloud management solution. A security vulnerability exists in several F5 products due to the configuration utility not adequately validating the 'Host' field in HTTP requests. An attacker could exploit this vulnerability to manipulate communications between IP addresses and fully qualified domain names. The following products and versions are affected: F5 BIG-IP 15.0.0 to 15.0.1, 14.0.0 to 14.1.2.2, 13.1.0 to 13.1.3.1, 12.1.0 to 12.1.5 , 11.5.1 to 11.6.5.1; iWorkflow 2.3.0; Enterprise Manager 3.1.1; BIG-IQ 7.0.0, 6.0.0 to 6.1.0, 5.2.0 to 5.4.0 Version

Trust: 1.71

sources: NVD: CVE-2019-6663 // JVNDB: JVNDB-2019-012043 // VULHUB: VHN-158098

AFFECTED PRODUCTS

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:5.4.0

Trust: 1.0

vendor:f5model:iworkflowscope:eqversion:2.3.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:eqversion:7.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:6.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:enterprise managerscope:eqversion:3.1.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:5.2.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:6.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.0.2

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:13.1.3

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.0.3

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.1.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.0.5

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.0.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.0

Trust: 0.6

sources: JVNDB: JVNDB-2019-012043 // CNNVD: CNNVD-201911-1021 // NVD: CVE-2019-6663

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6663
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-6663
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201911-1021
value: MEDIUM

Trust: 0.6

VULHUB: VHN-158098
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-6663
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-158098
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6663
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2019-6663
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-158098 // JVNDB: JVNDB-2019-012043 // CNNVD: CNNVD-201911-1021 // NVD: CVE-2019-6663

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-158098 // JVNDB: JVNDB-2019-012043 // NVD: CVE-2019-6663

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-1021

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-1021

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-012043

PATCH

title:K76052144url:https://support.f5.com/csp/article/K76052144

Trust: 0.8

sources: JVNDB: JVNDB-2019-012043

EXTERNAL IDS

db:NVDid:CVE-2019-6663

Trust: 2.5

db:JVNDBid:JVNDB-2019-012043

Trust: 0.8

db:CNNVDid:CNNVD-201911-1021

Trust: 0.7

db:AUSCERTid:ESB-2019.4310

Trust: 0.6

db:VULHUBid:VHN-158098

Trust: 0.1

sources: VULHUB: VHN-158098 // JVNDB: JVNDB-2019-012043 // CNNVD: CNNVD-201911-1021 // NVD: CVE-2019-6663

REFERENCES

url:https://support.f5.com/csp/article/k76052144

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2019-6663

Trust: 1.4

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6663

Trust: 0.8

url:https://vigilance.fr/vulnerability/f5-big-ip-information-disclosure-via-dns-rebinding-30879

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2019.4310/

Trust: 0.6

sources: VULHUB: VHN-158098 // JVNDB: JVNDB-2019-012043 // CNNVD: CNNVD-201911-1021 // NVD: CVE-2019-6663

SOURCES

db:VULHUBid:VHN-158098
db:JVNDBid:JVNDB-2019-012043
db:CNNVDid:CNNVD-201911-1021
db:NVDid:CVE-2019-6663

LAST UPDATE DATE

2024-11-23T22:25:44.979000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-158098date:2019-11-19T00:00:00
db:JVNDBid:JVNDB-2019-012043date:2019-11-25T00:00:00
db:CNNVDid:CNNVD-201911-1021date:2019-11-20T00:00:00
db:NVDid:CVE-2019-6663date:2024-11-21T04:46:54.610

SOURCES RELEASE DATE

db:VULHUBid:VHN-158098date:2019-11-15T00:00:00
db:JVNDBid:JVNDB-2019-012043date:2019-11-25T00:00:00
db:CNNVDid:CNNVD-201911-1021date:2019-11-15T00:00:00
db:NVDid:CVE-2019-6663date:2019-11-15T21:15:11.480