F5 BIG-IP APM Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP APM versions 21.0.0, 17.5.0 through 17.5.1, and 17.1.0 through 17.1.3. When an APM access policy is active on a virtual server, certain undisclosed traffic can lead to the termination of the 'apmd' process. This disruption causes a temporary outage as the process restarts, allowing for an unauthenticated attacker to exploit this issue and cause a DoS condition on the BIG-IP APM system.

Impact

Exploitation of this vulnerability disrupts traffic by causing the 'apmd' process to terminate and restart, leading to a temporary denial-of-service condition on the BIG-IP APM system.

Remediation

Users can upgrade to BIG-IP APM versions 21.0.0.1, 17.5.1.4, or 17.1.3.1 to address this vulnerability. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.