CVE-2019-6608

Published: Mar 28, 2019Modified: Jun 17, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-IP vCMP guest when processing authorized SNMP requests.

Affected (52)

Products: F5: Big Ip Access Policy Manager, Big Ip Advanced Firewall Manager, Big Ip Application Acceleration Manager, Big Ip Edge Gateway, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Local Traffic Manager, Big Ip Policy Enforcement Manager, Big Ip Protocol Security Manager, Big Ip Protocol Security Module, Big Ip Webaccelerator, Big Ip Analytics, Big Ip Application Security Manager

14 products

Big Ip Access Policy Manager

Big Ip Advanced Firewall Manager

Big Ip Application Acceleration Manager

Big Ip Edge Gateway

Big Ip Fraud Protection Service

Big Ip Global Traffic Manager

Big Ip Link Controller

Big Ip Local Traffic Manager

Big Ip Policy Enforcement Manager

Big Ip Protocol Security Manager

Big Ip Protocol Security Module

Big Ip Webaccelerator

Big Ip Analytics

Big Ip Application Security Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Access Policy Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Access Policy Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Access Policy Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Access Policy Manager	14.0.0 ≤ version ≤ 14.0.0.2

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Advanced Firewall Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Advanced Firewall Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Advanced Firewall Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Advanced Firewall Manager	14.0.0 ≤ version ≤ 14.0.0.2

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Application Acceleration Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Application Acceleration Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Application Acceleration Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Application Acceleration Manager	14.0.0 ≤ version ≤ 14.0.0.2

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Edge Gateway	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Edge Gateway	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Edge Gateway	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Edge Gateway	14.0.0 ≤ version ≤ 14.0.0.2

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Fraud Protection Service	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Fraud Protection Service	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Fraud Protection Service	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Fraud Protection Service	14.0.0 ≤ version ≤ 14.0.0.2

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Global Traffic Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Global Traffic Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Global Traffic Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Global Traffic Manager	14.0.0 ≤ version ≤ 14.0.0.2

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Link Controller	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Link Controller	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Link Controller	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Link Controller	14.0.0 ≤ version ≤ 14.0.0.2

Configuration H

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Local Traffic Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Local Traffic Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Local Traffic Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Local Traffic Manager	14.0.0 ≤ version ≤ 14.0.0.2

Configuration I

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Policy Enforcement Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Policy Enforcement Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Policy Enforcement Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Policy Enforcement Manager	14.0.0 ≤ version ≤ 14.0.0.2

Configuration J

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Protocol Security Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Protocol Security Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Protocol Security Manager	14.0.0 ≤ version ≤ 14.0.0.2
F5 Big Ip Protocol Security Module	11.2.1 ≤ version ≤ 11.6.3

Configuration K

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Webaccelerator	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Webaccelerator	12.0.0 ≤ version ≤ 12.1.3
F5 Big Ip Webaccelerator	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Webaccelerator	14.0.0 ≤ version ≤ 14.0.0.2

Configuration L

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Analytics	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Analytics	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Analytics	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Analytics	14.0.0 ≤ version ≤ 14.0.0.2

Configuration M

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Application Security Manager	11.2.1 ≤ version ≤ 11.6.3
F5 Big Ip Application Security Manager	12.1.0 ≤ version ≤ 12.1.3
F5 Big Ip Application Security Manager	13.0.0 ≤ version ≤ 13.1.1.1
F5 Big Ip Application Security Manager	14.0.0 ≤ version ≤ 14.0.0.2

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (2)

https://support.f5.com/csp/article/K12139752

Source: f5sirt@f5.com

Vendor Advisory

https://support.f5.com/csp/article/K12139752

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.