K11330536 : BIG-IP Appliance mode vulnerability CVE-2019-6635

Security Advisory Description

When the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions. (CVE-2019-6635)

Impact

BIG-IP

This vulnerability allows local attackers with high-level privileges to overwrite arbitrary files. This behavior is possible only when the BIG-IP system runs in Appliance mode on any of the hardware platforms, and the user account is configured with Administrator or Resource Administrator role. Resource Administrator roles must have TMOS Shell (tmsh) access to perform the attack. Appliance mode is a licensed feature. This vulnerability does not affect the virtual platforms.

Enterprise Manager / BIG-IQ / F5 iWorkflow / Traffix SDC

There is no impact; F5 products are not affected by this vulnerability.