Sign-up

ID

VAR-201903-0194


CVE

CVE-2019-6601


TITLE

BIG-IP Application Acceleration Manager Permissions vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-002614

DESCRIPTION

In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager (AAM) wamd process used in processing of images and PDFs fails to drop group permissions when executing helper scripts. BIG-IP Application Acceleration Manager (AAM) Contains a permission vulnerability.Information may be obtained. F5 BIG-IP AAM is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information. Information obtained may lead to further attacks. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. The following versions are affected: F5 BIG-IP Version 13.0.0, Version 12.1.0 to Version 12.1.3.7, Version 11.6.1 to Version 11.6.3.2, Version 11.5.1 to Version 11.5.8

Trust: 2.07

sources: NVD: CVE-2019-6601 // JVNDB: JVNDB-2019-002614 // BID: 107444 // VULHUB: VHN-158036 // VULMON: CVE-2019-6601

AFFECTED PRODUCTS

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:eqversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.2.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip aamscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:12.1.3

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:12.1.2

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:12.1.2

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:12.1.2

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:12.1.1

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:12.1

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:12.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip aam hf3scope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip aam buildscope:eqversion:11.5.40.1.256

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip aam hf6scope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip aam hf11scope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip aam hf10scope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip aam buildscope:eqversion:11.5.110.104.180

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5

Trust: 0.3

vendor:f5model:big-ip aam hf6scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf5scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf4scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf3scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam build 685-hf10scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf9scope:eqversion:11.4

Trust: 0.3

vendor:f5model:big-ip aam hf8scope:eqversion:11.4

Trust: 0.3

vendor:f5model:big-ip aam hf2scope:eqversion:11.4

Trust: 0.3

vendor:f5model:big-ip aam hf10scope:eqversion:11.4

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.3

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.2.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:12.1.0

Trust: 0.3

vendor:f5model:big-ip aam hf6scope:eqversion:11.5.5.11.5.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip aam hf9scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf8scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aam hf10scope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.4.0

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:13.1

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:13.0.1

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:neversion:13.0

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:12.1.4

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.5.9

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.6.3.3

Trust: 0.3

sources: BID: 107444 // JVNDB: JVNDB-2019-002614 // NVD: CVE-2019-6601

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6601
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-6601
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201903-431
value: MEDIUM

Trust: 0.6

VULHUB: VHN-158036
value: LOW

Trust: 0.1

VULMON: CVE-2019-6601
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2019-6601
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-158036
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6601
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2019-6601
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-158036 // VULMON: CVE-2019-6601 // JVNDB: JVNDB-2019-002614 // CNNVD: CNNVD-201903-431 // NVD: CVE-2019-6601

PROBLEMTYPE DATA

problemtype:CWE-269

Trust: 1.1

problemtype:CWE-275

Trust: 0.9

sources: VULHUB: VHN-158036 // JVNDB: JVNDB-2019-002614 // NVD: CVE-2019-6601

THREAT TYPE

local

Trust: 0.9

sources: BID: 107444 // CNNVD: CNNVD-201903-431

TYPE

Design Error

Trust: 0.9

sources: BID: 107444 // CNNVD: CNNVD-201903-431

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-002614

PATCH
title:K25359902url:https://support.f5.com/csp/article/K25359902
Trust: 0.8
title:F5 BIG-IP Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90047
Trust: 0.6
title: - url:https://github.com/Live-Hack-CVE/CVE-2019-6601 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-6601 // 
            
            
            
            JVNDB: JVNDB-2019-002614 // 
            
            
            
            CNNVD: CNNVD-201903-431

EXTERNAL IDS
db:NVDid:CVE-2019-6601
Trust: 2.9
db:BIDid:107444
Trust: 2.1
db:JVNDBid:JVNDB-2019-002614
Trust: 0.8
db:CNNVDid:CNNVD-201903-431
Trust: 0.7
db:AUSCERTid:ESB-2019.0773
Trust: 0.6
db:VULHUBid:VHN-158036
Trust: 0.1
db:VULMONid:CVE-2019-6601
Trust: 0.1
sources:
            
            
            VULHUB: VHN-158036 // 
            
            
            
            VULMON: CVE-2019-6601 // 
            
            
            
            BID: 107444 // 
            
            
            
            JVNDB: JVNDB-2019-002614 // 
            
            
            
            CNNVD: CNNVD-201903-431 // 
            
            
            
            NVD: CVE-2019-6601

REFERENCES
url:http://www.securityfocus.com/bid/107444
Trust: 2.5
url:https://support.f5.com/csp/article/k25359902
Trust: 2.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-6601
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6601
Trust: 0.8
url:https://vigilance.fr/vulnerability/f5-big-ip-aam-privilege-escalation-via-wamd-28719
Trust: 0.6
url:https://www.auscert.org.au/bulletins/76870
Trust: 0.6
url:http://www.f5.com/products/big-ip/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/269.html
Trust: 0.1
url:https://github.com/live-hack-cve/cve-2019-6601
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-158036 // 
            
            
            
            VULMON: CVE-2019-6601 // 
            
            
            
            BID: 107444 // 
            
            
            
            JVNDB: JVNDB-2019-002614 // 
            
            
            
            CNNVD: CNNVD-201903-431 // 
            
            
            
            NVD: CVE-2019-6601

CREDITS
The vendor reported this issue.
Trust: 0.9
sources:
            
            
            BID: 107444 // 
            
            
            
            CNNVD: CNNVD-201903-431

SOURCES
db:VULHUBid:VHN-158036
db:VULMONid:CVE-2019-6601
db:BIDid:107444
db:JVNDBid:JVNDB-2019-002614
db:CNNVDid:CNNVD-201903-431
db:NVDid:CVE-2019-6601

LAST UPDATE DATE
2024-11-23T22:48:25.878000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-158036date:2023-02-10T00:00:00
db:VULMONid:CVE-2019-6601date:2023-02-10T00:00:00
db:BIDid:107444date:2019-03-12T00:00:00
db:JVNDBid:JVNDB-2019-002614date:2019-04-15T00:00:00
db:CNNVDid:CNNVD-201903-431date:2020-08-25T00:00:00
db:NVDid:CVE-2019-6601date:2024-11-21T04:46:46.980

SOURCES RELEASE DATE
db:VULHUBid:VHN-158036date:2019-03-13T00:00:00
db:VULMONid:CVE-2019-6601date:2019-03-13T00:00:00
db:BIDid:107444date:2019-03-12T00:00:00
db:JVNDBid:JVNDB-2019-002614date:2019-04-15T00:00:00
db:CNNVDid:CNNVD-201903-431date:2019-03-12T00:00:00
db:NVDid:CVE-2019-6601date:2019-03-13T22:29:00.597