CVE-2019-6608 : Security Advisory and Response

CVE-2019-6608 was published on March 28, 2019, by F5 for BIG-IP products, highlighting a memory leakage vulnerability when processing SNMP requests.

Understanding CVE-2019-6608

What is CVE-2019-6608?

CVE-2019-6608 is a vulnerability affecting BIG-IP products that can lead to memory leakage on a multi-blade BIG-IP vCMP guest when processing authorized SNMP requests.

The Impact of CVE-2019-6608

This vulnerability can be exploited to cause a Denial of Service (DoS) condition on affected systems, potentially disrupting services and operations.

Technical Details of CVE-2019-6608

Vulnerability Description

The snmpd daemon on BIG-IP versions 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2 may leak memory under specific conditions when processing SNMP requests.

Affected Systems and Versions

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Versions: 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, 14.0.0-14.0.0.2

Exploitation Mechanism

The vulnerability arises during the handling of authorized SNMP requests, leading to memory leakage on a multi-blade BIG-IP vCMP guest.

Mitigation and Prevention

Immediate Steps to Take

Apply the necessary patches provided by F5 to address the vulnerability.
Monitor SNMP traffic for any unusual patterns that could indicate exploitation.

Long-Term Security Practices

Regularly update and patch BIG-IP systems to prevent known vulnerabilities.
Implement network segmentation to limit the impact of potential attacks.

Patching and Updates

Ensure that all BIG-IP systems are updated with the latest patches and firmware releases to mitigate the risk of memory leakage vulnerabilities.