CVE-2017-6160 Denial of service in BIG-IP AAM, PEM

Medium 5.9 Published 27 Oct 2017 Updated 16 Sep 2024

Remote attackers can cause a denial of service by sending crafted HTTP requests to systems with specific AAM or PEM profiles enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-6160?

CVE-2017-6160 is a medium-severity denial of service vulnerability in F5 Big-Ip Application Acceleration Manager, published on 27 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel (TMM) to restart and temporarily fail to process traffic. This issue is exposed on virtual servers using a Policy Enforcement profile or a Web Acceleration profile. Systems that do not have BIG-IP AAM module provisioned are not vulnerable. The Traffic Management Microkernel (TMM) may restart and temporarily fail to process traffic. Systems that do not have BIG-IP AAM or PEM module provisioned are not vulnerable.

Which versions are affected by CVE-2017-6160?

It affects 2 products.

Products include F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Policy Enforcement Manager.

How do I fix CVE-2017-6160?

No fix has been published for CVE-2017-6160 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-6160 being exploited?

There is no known exploitation of CVE-2017-6160 in the wild and no public exploit code.

All F5 Big-Ip Application Acceleration Manager vulnerabilities

Sources

Also known as GHSA-ggm9-mvqx-95xh.