#VU22850 Inclusion of Sensitive Information in Log Files in F5 Networks products


Vulnerability identifier: #VU22850

Vulnerability risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-6662

CWE-ID: CWE-532

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
BIG-IP LTM
Hardware solutions / Security hardware applicances
BIG-IP FPS
Hardware solutions / Security hardware applicances
BIG-IP AFM
Hardware solutions / Security hardware applicances
BIG-IP Analytics
Hardware solutions / Security hardware applicances
BIG-IP APM
Hardware solutions / Security hardware applicances
BIG-IP ASM
Hardware solutions / Security hardware applicances
BIG-IP GTM
Hardware solutions / Security hardware applicances
BIG-IP PEM
Hardware solutions / Security hardware applicances
BIG-IP AAM
Hardware solutions / Routers & switches, VoIP, GSM, etc
BIG-IP Edge Gateway
Hardware solutions / Routers & switches, VoIP, GSM, etc
BIG-IP WebAccelerator
Hardware solutions / Routers & switches, VoIP, GSM, etc
BIG-IP DNS
Hardware solutions / Routers & switches, VoIP, GSM, etc
BIG-IP Link Controller
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: F5 Networks

Description

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exists due to sensitive information is logged into the local log files and/or remote logging targets when the "restjavad" procces processes an invalid request. A remote attacker with access to the log files can view sensitive information.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

BIG-IP LTM: 13.1.0 - 13.1.1

BIG-IP AAM: 13.1.0 - 13.1.1

BIG-IP Edge Gateway: 13.1.0 - 13.1.1

BIG-IP FPS: 13.1.0 - 13.1.1

BIG-IP WebAccelerator: 13.1.0 - 13.1.1

BIG-IP AFM: 13.1.0 - 13.1.1

BIG-IP Analytics: 13.1.0 - 13.1.1

BIG-IP APM: 13.1.0 - 13.1.1

BIG-IP ASM: 13.1.0 - 13.1.1

BIG-IP DNS: 13.1.0 - 13.1.1

BIG-IP GTM: 13.1.0 - 13.1.1

BIG-IP Link Controller: 13.1.0 - 13.1.1

BIG-IP PEM: 13.1.0 - 13.1.1

External links
http://support.f5.com/csp/article/K01049383

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Information disclosure in F5 products