CVE-2019-6660 : What You Need to Know

A vulnerability in BIG-IP versions 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1 could lead to a denial of service due to undisclosed HTTP requests consuming excessive system resources.

Understanding CVE-2019-6660

This CVE involves a potential denial of service risk on specific versions of BIG-IP.

What is CVE-2019-6660?

CVE-2019-6660 is a vulnerability in BIG-IP versions 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1 that could allow attackers to exhaust system resources through undisclosed HTTP requests, potentially resulting in a denial of service.

The Impact of CVE-2019-6660

The vulnerability has the potential to cause a denial of service by excessively consuming system resources, impacting the availability of services running on affected BIG-IP versions.

Technical Details of CVE-2019-6660

This section provides technical details about the vulnerability.

Vulnerability Description

Undisclosed HTTP requests on BIG-IP versions 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1 can lead to the excessive consumption of system resources, potentially resulting in a denial of service (DoS) condition.

Affected Systems and Versions

Product: BIG-IP
Versions Affected: 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.1

Exploitation Mechanism

Attackers can exploit this vulnerability by sending undisclosed HTTP requests to the affected versions of BIG-IP, causing a depletion of system resources and potentially leading to a denial of service.

Mitigation and Prevention

Protecting systems from CVE-2019-6660 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply vendor-supplied patches or updates to mitigate the vulnerability.
Monitor system resources for unusual consumption that could indicate a potential attack.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Implement network security measures to detect and prevent DoS attacks.

Patching and Updates

Check for and apply patches provided by the vendor to address the vulnerability in affected versions of BIG-IP.