CVE-2019-6609

EPSS 0.47%
Published 15.04.2019 15:29:00
Last modified 21.11.2024 04:46:47
Source f5sirt@f5.com
Teams watchlist Login
Open Login

Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) versions 14.0.0-14.1.0.1, 13.0.0-13.1.1.3, and 12.1.1 HF2-12.1.4, the secureKeyCapable attribute was not set which causes secure vault to not use the F5 hardware support to store the unit key. Instead the unit key is stored in plaintext on disk as would be the case for Z100 systems. Additionally this causes the unit key to be stored in UCS files taken on these platforms.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.2 < 12.1.4.1

   F5 ≫ Big-ip I10600 Version-
   F5 ≫ Big-ip I10800 Version-
   F5 ≫ Big-ip I11600 Version-
   F5 ≫ Big-ip I11800 Version-
   F5 ≫ Big-ip I15600 Version-
   F5 ≫ Big-ip I15800 Version-
   F5 ≫ Big-ip I2000s Version-
   F5 ≫ Big-ip I2200s Version-
   F5 ≫ Big-ip I4000s Version-
   F5 ≫ Big-ip I4200v Version-
   F5 ≫ Big-ip I5000s Version-
   F5 ≫ Big-ip I5050s Version-
   F5 ≫ Big-ip I5200v Version-
   F5 ≫ Big-ip I5250v Version-
   F5 ≫ Big-ip I5250v Fips Version-
   F5 ≫ Big-ip I7000 Version-
   F5 ≫ Big-ip I7050s Version-
   F5 ≫ Big-ip I7055s Version-
   F5 ≫ Big-ip I7200v Version-
   F5 ≫ Big-ip I7200v-ssl Version-
   F5 ≫ Big-ip I7200v Fips Version-
   F5 ≫ Big-ip I7250v Version-
   F5 ≫ Big-ip I7255s Version-

F5 ≫ Big-ip Local Traffic Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Local Traffic Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Application Acceleration Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Application Acceleration Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Application Acceleration Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Advanced Firewall Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Analytics Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Analytics Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Analytics Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Analytics Version12.1.1 Updatehf2

F5 ≫ Big-ip Access Policy Manager Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Access Policy Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Access Policy Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Access Policy Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Application Security Manager Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Application Security Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Application Security Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Application Security Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Domain Name System Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Domain Name System Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Domain Name System Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Domain Name System Version12.1.1 Updatehf2

F5 ≫ Big-ip Edge Gateway Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Edge Gateway Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Edge Gateway Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Edge Gateway Version12.1.1 Updatehf2

F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Fraud Protection Service Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Fraud Protection Service Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Fraud Protection Service Version12.1.1 Updatehf2

F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Global Traffic Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Global Traffic Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Global Traffic Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Link Controller Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Link Controller Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Link Controller Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Link Controller Version12.1.1 Updatehf2

F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Policy Enforcement Manager Version12.1.1 Updatehf2

F5 ≫ Big-ip Webaccelerator Version >= 12.1.2 < 12.1.4.1

F5 ≫ Big-ip Webaccelerator Version >= 13.0.0 < 13.1.1.4

F5 ≫ Big-ip Webaccelerator Version >= 14.0.0 < 14.1.0.2

F5 ≫ Big-ip Webaccelerator12.1.1 Versionhf2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.47%	0.617

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://support.f5.com/csp/article/K18535734

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-6609

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-6609

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-6609

EUVD