Critical Buffer Overflow Vulnerability in F5 BIG-IP Exposes Systems to Remote Code Execution

What changed

A critical stack-based buffer overflow vulnerability has been discovered in F5 BIG-IP products. This vulnerability arises when a BIG-IP APM access policy is configured on a virtual server, allowing specific malicious traffic to trigger remote code execution (RCE).

Organizations using affected versions of BIG-IP should be aware that software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Who is affected

The vulnerability impacts various configurations of F5 BIG-IP, particularly those utilizing the APM access policy feature. Organizations relying on these systems for application delivery and security are at risk.

Specific groups that may be affected include enterprises using F5 BIG-IP for load balancing, security teams managing application access, and IT departments responsible for maintaining network infrastructure.

• F5 BIG-IP users with APM access policies configured
• Enterprises utilizing F5 for application delivery
• IT departments managing network security

What to do

Organizations should assess their use of F5 BIG-IP and determine if they are running versions that are vulnerable to this buffer overflow issue. Immediate action is recommended to mitigate potential risks.

F5 has not yet released a patch, but users are advised to monitor for updates and apply them as soon as they become available. Additionally, implementing network security measures to filter malicious traffic may help reduce exposure.

• Evaluate current F5 BIG-IP versions in use
• Monitor for vendor updates and patches
• Implement network security measures to filter malicious traffic