CVE-2019-6617

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.2 through 11.5.8 F5 BIG-IP versions 11.6.1 through 11.6.3.4 F5 BIG-IP versions 12.1.0 through 12.1.4 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.1.0.1

Description A user with the Resource Administrator role can overwrite sensitive low-level files, such as /etc/passwd, using SFTP to modify user permissions without Advanced Shell access. This is contrary to the definition for the Resource Administrator role restrictions.

Recommendations For F5 BIG-IP versions 11.5.2 through 11.5.8, restrict SFTP access for users with the Resource Administrator role to prevent modification of sensitive files. For F5 BIG-IP versions 11.6.1 through 11.6.3.4, restrict SFTP access for users with the Resource Administrator role to prevent modification of sensitive files. For F5 BIG-IP versions 12.1.0 through 12.1.4, restrict SFTP access for users with the Resource Administrator role to prevent modification of sensitive files. For F5 BIG-IP versions 13.0.0 through 13.1.1.4, restrict SFTP access for users with the Resource Administrator role to prevent modification of sensitive files. For F5 BIG-IP versions 14.0.0 through 14.1.0.1, restrict SFTP access for users with the Resource Administrator role to prevent modification of sensitive files.