Vulnerability in F5 Big-Ip Access Policy Manager
CVE-2019-6609
Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit key to be stored in UCS files taken on these platforms.
EPSS: 0.015 (72.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- F5 Big-ip_access_policy_manager — versions 12.1.1
- F5 Big-ip_advanced_firewall_manager — versions 12.1.1
- F5 Big-ip_analytics — versions 12.1.1
- F5 Big-ip Apm — versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, 12.1.1 HF2-12.1.4
- F5 Big-ip_application_acceleration_manager — versions 12.1.1
- F5 Big-ip_application_security_manager — versions 12.1.1
- F5 Big-ip_domain_name_system — versions 12.1.1
- F5 Big-ip_edge_gateway — versions 12.1.1
- F5 Big-ip_fraud_protection_service — versions 12.1.1
- F5 Big-ip_global_traffic_manager — versions 12.1.1
Weakness classification (CWE)
References
- f5sirt@f5.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-6609?
- CVE-2019-6609 is a critical-severity vulnerability in F5 Big-Ip Access Policy Manager, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2019-04-15.
- How severe is CVE-2019-6609?
- Critical severity. CVSS v3 base score is 9.8 out of 10.