CVE-2014-6032

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM versions 10.0.0 through 11.6.0 F5 BIG-IP ASM versions 11.0 through 11.6.0 F5 BIG-IP GTM versions 10.0.0 through 11.6.0 F5 BIG-IP Link Controller versions 10.0.0 through 11.6.0 F5 BIG-IP AAM versions 11.4.0 through 11.6.0 F5 BIG-IP ARM versions 11.3.0 through 11.6.0 F5 BIG-IP Analytics versions 11.0.0 through 11.6.0 F5 BIG-IP APM and Edge Gateway versions 10.1.0 through 11.6.0 F5 BIG-IP PEM versions 11.3.0 through 11.6.0 F5 BIG-IP PSM versions 10.0.0 through 11.4.1 F5 BIG-IP WOM versions 10.0.0 through 11.3.0 F5 Enterprise Manager versions 2.1.0 through 3.1.1

Description The issue allows remote authenticated users to read arbitrary files and cause a denial of service via a crafted request. This can be achieved by exploiting the viewList or deal elements in the Configuration utility.

Recommendations For F5 BIG-IP LTM versions 10.0.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP ASM versions 11.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP GTM versions 10.0.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP Link Controller versions 10.0.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP AAM versions 11.4.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP ARM versions 11.3.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP Analytics versions 11.0.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP APM and Edge Gateway versions 10.1.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP PEM versions 11.3.0 through 11.6.0, update to a version outside of the affected range. For F5 BIG-IP PSM versions 10.0.0 through 11.4.1, update to a version outside of the affected range. For F5 BIG-IP WOM versions 10.0.0 through 11.3.0, update to a version outside of the affected range. For F5 Enterprise Manager versions 2.1.0 through 3.1.1, update to a version outside of the affected range.