Applies To:

Show Versions Show Versions

Supplemental Document: Release Information: BIG-IP 11.6.2

Original Publication Date: 10/26/2017

BIG-IP Release Information

Version: 11.6.2
Build: 495.0

Cumulative fixes from BIG-IP v11.6.1 Hotfix 2 that are included in this release
Cumulative fixes from BIG-IP v11.6.1 Hotfix 1 that are included in this release
Cumulative fixes from BIG-IP v11.6.1 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 8 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 7 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 6 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 5 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 4 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 3 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 2 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 1 that are included in this release
Known Issues in BIG-IP v11.6.x

Vulnerability Fixes

ID Number CVE Solution Article(s) Description
653880-1 CVE-2017-6214 K81211720 Kernel Vulnerability: CVE-2017-6214
652516-1 CVE-2016-10088 CVE-2016-10142 CVE-2016-2069 CVE-2016-2384 CVE-2016-6480 CVE-2016-7042 CVE-2016-7097 CVE-2016-8399 CVE-2016-9576 K31603170 Multiple Linux Kernel Vulnerabilities
649907-3 CVE-2017-3137 K30164784 BIND vulnerability CVE-2017-3137
649904-3 CVE-2017-3136 K23598445 BIND vulnerability CVE-2017-3136
648865-1 CVE-2017-6074 K82508682 Linux kernel vulnerability: CVE-2017-6074
644904-4 CVE-2016-7922, CVE-2016-7923, CVE-2016-7924, CVE-2016-7925, CVE-2016-7926, CVE-2016-7927, CVE-2016-7928, CVE-2016-7929, CVE-2016-7930, CVE-2016-7931, CVE-2016-7932, CVE-2016-7933, CVE-2016-7934, CVE-2016-7935, CVE-2016-7936, CVE-2016-7937, CVE-2016-7938, CVE-2016-7939, CVE-2016-7940, CVE-2016-7973, CVE-2016-7986, CVE-2016-7992, CVE-2016-7993, CVE-2016-8574, CVE-2016-8575, CVE-2016-7974, CVE-2016-7975, CVE-2016-7983, CVE-2016-7984, CVE-2016-7985
CVE-2017-5202, CVE-2017-5203, CVE-2017-5204, CVE-2017-5205, CVE-2017-5341, CVE-2017-5342, CVE-2017-5482, CVE-2017-5483, CVE-2017-5484, CVE-2017-5485, CVE-2017-5486
K55129614 tcpdump 4.9
644693-4 CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231,CVE-2016-5547,CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2017-3241 K15518610 Fix for multiple CVE for openjdk-1.7.0
643187-3 CVE-2017-3135 K80533167 BIND vulnerability CVE-2017-3135
641360-3 CVE-2017-0303 K30201296 SOCKS proxy protocol error
638556-3 CVE-2016-10045 K73926196 PHP Vulnerability: CVE-2016-10045
636702-2 CVE-2016-9444 K40181790 BIND vulnerability CVE-2016-9444
636700-3 CVE-2016-9147 K02138183 BIND vulnerability CVE-2016-9147
636699-4 CVE-2016-9131 K86272821 BIND vulnerability CVE-2016-9131
630475-4 CVE-2017-6162 K13421245 TMM Crash
626360-5 CVE-2017-6163 K22541983 TMM may crash when processing HTTP2 traffic
624526-1 CVE-2017-6159 K10002335 TMM core in mptcp
610255-2 CVE-2017-6161 K62279530 CMI improvement
563154-2 CVE-2015-2925 CVE-2015-5307 CVE-2015-7613 CVE-2015-7872 CVE-2015-8104 K31026324 K94105604 K90230486 Multiple Linux Kernel vulnerabilities
560109-3 CVE-2017-6160 K19430431 Client capabilities failure
540174-3 CVE-2015-5364 CVE-2015-5366 K17307 K17309 CVE updates from https://rhn.redhat.com/errata/RHSA-2015-1623.html
648879-1 CVE-2016-6136 CVE-2016-9555 K90803619 Linux kernel vulnerabilities: CVE-2016-6136 CVE-2016-9555
645101-4 CVE-2017-3731, CVE-2017-3732 K44512851 OpenSSL vulnerability CVE-2017-3732
640768-1 CVE-2016-10088 K05513373 Kernel vulnerability: CVE-2016-10088
638137-1 CVE-2016-7117 CVE-2016-4998 CVE-2016-6828 K51201255 CVE-2016-7117 CVE-2016-4998 CVE-2016-6828
637666-3 CVE-2016-10033 K74977440 PHP Vulnerability: CVE-2016-10033
635314-4 CVE-2016-1248 K22183127 vim Vulnerability: CVE-2016-1248
631688-4 CVE-2016-9311 CVE-2016-9310 CVE-2016-7427 CVE-2016-7428 CVE-2016-9312 CVE-2016-7431 CVE-2016-7434 CVE-2016-7429 CVE-2016-7426 CVE-2016-7433 K55405388 K87922456 K63326092 K51444934 K80996302 Multiple NTP vulnerabilities
625372-2 CVE-2016-2179 K23512141 OpenSSL vulnerability CVE-2016-2179
623119-6 CVE-2016-4470 K55672042 Linux kernel vulnerability CVE-2016-4470
622496-6 CVE-2016-5829 K28056114 Linux kernel vulnerability CVE-2016-5829
622126-3 CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 K54308010 PHP vulnerability CVE-2016-7124
614147-3 CVE-2017-6157 K02692210 SOCKS proxy defect resolution
613225-3 CVE-2016-2180, CVE-2016-6306, CVE-2016-6302 K90492697 OpenSSL vulnerability CVE-2016-6306
613127-6 CVE-2016-5696 K46514822 Linux TCP Stack vulnerability CVE-2016-5696
607314-3 CVE-2016-3500, CVE-2016-3508 K25075696 Oracle Java vulnerability CVE-2016-3500, CVE-2016-3508
600232-4 CVE-2016-2177 K23873366 OpenSSL vulnerability CVE-2016-2177
600223-4 CVE-2016-2177 K23873366 OpenSSL vulnerability CVE-2016-2177
592485-2 CVE-2015-5157 CVE-2015-8767 K17326 Linux kernel vulnerability CVE-2015-5157
592001-2 CVE-2016-4071 CVE-2016-4073 K64412100 CVE-2016-4073 PHP vulnerabilities
540018-2 CVE-2014-3940 CVE-2014-3184 CVE-2015-0239 K16429 K15685 K15912 Multiple Linux Kernel Vulnerabilities
533413-4 CVE-2011-5321 CVE-2015-3636 CVE-2015-1593 CVE-2015-2830 CVE-2015-2922 K51518670 CVE updates from https://rhn.redhat.com/errata/RHSA-2015-1221.html
527563-6 CVE-2015-1805 CVE-2015-3331 CVE-2014-9419 CVE-2014-9420 CVE-2014-9585 K17458 K16819 K17551 K17543 K17241 Kernel Vulnerabilities
600205-4 CVE-2016-2178 K53084033 OpenSSL Vulnerability: CVE-2016-2178
598002-3 CVE-2016-2178 K53084033 OpenSSL vulnerability CVE-2016-2178
591438-2 CVE-2015-8865 K54924436 PHP vulnerability CVE-2015-8865
569355-3 CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 K50118123 Java vulnerabilities CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494
492732-2 CVE-2014-3184 K15912 Linux kernel driver vulnerabilities CVE-2014-3184, CVE-2014-3185, CVE-2014-3611, CVE-2014-3645, and CVE-2014-3646
655021-3 CVE-2017-3138 K23598445 BIND vulnerability CVE-2017-3138
621935-3 CVE-2016-6304 K54211024 OpenSSL vulnerability CVE-2016-6304


Functional Change Fixes

ID Number Severity Solution Article(s) Description
643210-1 2-Critical K45444280 Restarting MCPD on Secondary Slot of Chassis causes deletion of netHSM keys on SafeNet HSM
633723-2 3-Major   New diagnostics run when a crypto HA failure occurs and crypto.ha.action is reboot
609674-2 3-Major K38333488 machine certificate check creates issuer string with DC with reverse order
545263-4 3-Major   Add SSL maximum aggregate active handshakes per profile and per global


TMOS Fixes

ID Number Severity Solution Article(s) Description
534824-1 1-Blocking K02954921 Incorrect key/certificate when creating clientSSL profile and modifying key/cert in the same transaction.
480073-1 1-Blocking   Adding a new chassis and syncing the configuration cause mcpd to restart.
655059-2 2-Critical   TMM Crash
638935-7 2-Critical   Monitor with send/receive string containing double-quote may cause upgrade to fail.
625824-3 2-Critical   iControl calls related to key and certificate management (Management::KeyCertificate) might leak memory
610354-2 2-Critical   TMM crash on invalid memory access to loopback interface stats object
542898-3 2-Critical   Virtual Edition: Disk partition /var shows 100% after live install to 12.0.0
528343-2 2-Critical   Loading cli preference that does not contain the user attribute will fail
514514-1 2-Critical K96156151 Running gtm_add can result in error message about encrypted attributes.
513151-8 2-Critical K17312 VIPRION B2150 blades show up as unknown when SNMP queries the OID sysObjectID.
483373-2 2-Critical   Incorrect bash prompt for created admin role users
667278-4 3-Major   DSC connections between BIG-IP units may fail to establish
650002-3 3-Major   tzdata bug fix and enhancement update
648316 3-Major   Flows using DEFLATE decompresion can generate error message during flow tear-down.
647944-3 3-Major   MCP may crash when making specific changes to a FIX profile attached to more than one virtual server
645179-3 3-Major K42751321 Traffic group becomes active on more than one BIG-IP after a long uptime
644184-1 3-Major K36427438 ZebOS daemons hang while AgentX SNMP daemon is waiting.
631627-5 3-Major   Applying BWC over route domain sometimes results in tmm not becoming ready on system start
628164-2 3-Major   OSPF with multiple processes may incorrectly redistribute routes
622133-4 3-Major   VCMP guests may incorrectly obtain incorrect MAC addresses
621273-4 3-Major   DSR tunnels with transparent monitors may cause TMM crash.
619060-2 3-Major   Reduction in boot time in BIG-IP Virtual Edition platforms
617628-2 3-Major   SNMP reports incorrect value for sysBladeTempTemperature OID
491406-1 3-Major   TMM SIGSEGV in sctp_output due to NULL snd_dst
485164-2 3-Major   MCPD cores when the Check Service Date in the license is not current.
393270-4 3-Major   Configuration utility may become non-responsive or fail to load.
655691-1 4-Minor   GUI image list contains misleading 'MD5 Sum Verified' field
654566-1 4-Minor K94822416 Incomplete files still linked in /shared/vmisolinks
634371-3 4-Minor   Cisco ethernet NIC driver
442322-2 4-Minor   vCMP guest names in statistics limited to 32 characters


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
618905-3 1-Blocking   tmm core while installing Safenet 6.2 client
684879-3 2-Critical   Malformed TLS1.2 records may result in TMM segmentation fault.
653993-2 2-Critical   A specific sequence of packets to the HA listener may cause tmm to produce a core file
646604-3 2-Critical K21005334 Client connection may hang when NTLM and OneConnect profiles used together
642400-1 2-Critical   Path MTU discovery occasionally fails
637181-3 2-Critical   VIP-on-VIP traffic may stall after routing updates
635274-3 2-Critical K21514205 SSL::sessionid command may return invalid values
634259 2-Critical   IP tuple nexthop object can be freed while still referenced by another structure
625198-3 2-Critical   TMM might crash when TCP DSACK is enabled
603667-3 2-Critical   TMM may leak or corrupt memory when configuration changes occur with plugins in use
600982-1 2-Critical   TMM crashes at ssl_cache_sid() with "prf->cache.sid == 0"
597978-4 2-Critical   GARPs may be transmitted by active going offline
581829-1 2-Critical   Traffic that uses a network HSM for crypto services can fail to recover.
566071-1 2-Critical   network-HSM may not be operational on secondary slots of a standby chassis.
503125-4 2-Critical   Excessive MPI net traffic can cause tmm panics on chassis systems
477195-3 2-Critical   OSPFv3 session gets stuck in loading state
474797 2-Critical   Malformed SSL packets can cause errors in /var/log/ltm
663326-3 3-Major   Thales HSM: "fipskey.nethsm --export" fails to make stub keys
654109-3 3-Major K01102467 Configuration loading may fail when iRules calling procs in other iRules are deleted
648954-3 3-Major K01102467 Configuration validation (e.g., ConfigSync) may fail after an iRule is deleted, if the iRule made procedure calls
643582-1 3-Major   Config load with large ssl profile configuration may cause tmm restart
624903-3 3-Major   Improved handling of crypto hardware decrypt failures on 2000s/2200s or 4000s/4200v platforms.
622178-3 3-Major   Improve flow handling when Autolasthop is disabled
613369-1 3-Major   Half-Open TCP Connections Not Discoverable
612694-3 3-Major   TCP::close with no pool member results in zombie flows
608551-4 3-Major   Half-closed congested SSL connections with unclean shutdown might stall.
604496-2 3-Major   SQL (Oracle) monitor daemon might hang.
508486-2 3-Major   TCP connections might stall if initialization fails
499615-3 3-Major K49031780 RAM cache serves zero length documents.
423392-5 3-Major   tcl_platform is no longer in the static:: namespace
511985-4 4-Minor K46811087 Large numbers of ERR_UNKNOWN appearing in the logs


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
468503-1 3-Major K17109 The Update Check operation reports a different version of IP geolocation database than what is installed.


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
618771-2 2-Critical   Some Social Security Numbers are not being masked
577668-1 2-Critical   ASM Remote logger doesn't log 64 KB request.
569583-1 2-Critical   Secondary Blade Rejects All Traffic after being added to the chassis
568347-2 2-Critical   BD Memory corruption
665905-1 3-Major K83305000 Signature System corruption from specific ASU prevents ASU load after upgrade
664930-1 3-Major   Policy automatic learning mode changes to manual after failover
625832-2 3-Major K89255958 A false positive modified domain cookie violation
616169-2 3-Major   ASM Policy Export returns HTML error file
604923-3 3-Major   REST id for Signatures change after update
572885-2 3-Major   Policy automatic learning mode changes to manual after failover
427644-2 3-Major K37066694 asm_config_server_rpc might crash during ASM policy sync
366605-1 3-Major   response_log_size_limit does not limit the log size.
557098-1 4-Minor   correlation is continuously restarted with "An instance with pid xxxx is already running" error in the ltm log


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
602654-3 2-Critical   TMM crash when using AVR lookups
639617 3-Major   When AVR collect Page load time and/or session data the Content-Length can be set incorrectly
635561-3 3-Major   Heavy URLs statistics are not shown after upgrade.
631722-2 3-Major   Some HTTP statistics not displayed after upgrade
573764-3 3-Major   In some cases, only primary blade retains it's statistics after upgrade on multi bladed system
570926-1 3-Major   Provide a way to configure where in payload the CSPM JS is injected.
560114-7 3-Major   Monpd is being affected by an I/O issue which makes some of its threads freeze
512303-1 3-Major K02471248 Install does not complete (stays at 0%) because the UCS save operation hangs while backing up the AVR database.
639395-1 4-Minor K91614278 AVR does not display 'Max read latency' units.


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
679235-4 2-Critical   Inspection Host NPAPI Plugin for Safari can not be installed
638570-2 2-Critical   "ACCESS::session remove" hangs in ACCESS_POLICY_COMPLETED
632798-1 2-Critical K30710317 Double-free may occur if Access initialization fails
499800-1 2-Critical K34140143 Customized logout page is not displayed after logon failure
481481-1 2-Critical   APM on a multi blade chassis: On an idle machine 'rewrite' processes can takes up to half CPU cycles.
676300-6 3-Major K04551025 EPSEC binaries may fail to upgrade in some cases
658852-1 3-Major   Empty User-Agent in iSessions requests from APM client on Windows
649613-1 3-Major   Multiple UDP/TCP packets packed into one DTLS Record
645684-1 3-Major   Flash application components are loaded into wrong ApplicationDomain after Portal Access rewriting.
638780-1 3-Major   Handle 302 redirects for VMware Horizon View HTML5 client
620829-4 3-Major   Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly
619486-1 3-Major   Scripts on rewritten pages could fail with JavaScript exception if application code modifies window.self
618170-1 3-Major   Some URL unwrapping functions can behave bad
615970-2 3-Major K02319425 SSO logging level may cause failover
601420-2 3-Major   Possible SAML authentication loop with IE and multi-domain SSO.
600069-3 3-Major   Portal Access: Requests handled incorrectly
597214-2 3-Major   Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly
583272-1 3-Major K11736022 "Corrupted Connect Error" when using IPv6 and On-Demand Cert Auth
559402-1 3-Major   Client initiated form based SSO fails when username and password not replaced correctly while posting the form
557841-1 3-Major   Policy sync fails when adding host to AppTunnel on LSO resolve
557399-2 3-Major   Browser could become unresponsive when page with specific script constructions is accessed through Portal Access
508699-1 3-Major K03737485 Import with reuse is failing if profile and resource are sharing the same name
474606-1 3-Major   [Flash AS3] ApplicationDomain matching fails for relative URLs
611968-1 4-Minor   JavaScript Active content at an HTML page browsed by IE8 with significant amount of links (>1000) can run very slow


WebAccelerator Fixes

ID Number Severity Solution Article(s) Description
476460-6 4-Minor K16143 WAM Range HTTP header limited to 8 ranges


Wan Optimization Manager Fixes

ID Number Severity Solution Article(s) Description
644970-2 2-Critical   Editing a virtual server config loses SSL encryption on iSession connections
644489-2 3-Major K14899014 Unencrypted iSession connection established even though data-encrypt configured in profile


Service Provider Fixes

ID Number Severity Solution Article(s) Description
649933-3 3-Major   Fragmented RADIUS messages may be dropped


Carrier-Grade NAT Fixes

ID Number Severity Solution Article(s) Description
652400-1 3-Major   During blade changes, PBA may cause a TMM restart


Global Traffic Manager (DNS) Fixes

ID Number Severity Solution Article(s) Description
624193-1 3-Major   Topology load balancing not working as expected
644220-2 4-Minor K37049259 Flawed logic when retrieving an LTM Virtual Server's assigned Link on the LTM Virtual Server Properties page



Cumulative fixes from BIG-IP v11.6.1 Hotfix 2 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
631582-4 CVE-2016-9250 K55792317 Administrative interface enhancement
624570-3 CVE-2016-8864 K35322517 BIND vulnerability CVE-2016-8864
624457-3 CVE-2016-5195 K10558632 Linux privilege-escalation vulnerability (Dirty COW) CVE-2016-5195
616864-3 CVE-2016-2776 K18829561 BIND vulnerability CVE-2016-2776
612128 CVE-2016-6515 K31510510 OpenSSH vulnerability CVE-2016-6515
611469-2 CVE-2016-7467 K95444512 Traffic disrupted when malformed, signed SAML authentication request from an authenticated user is sent via SP connector
597394-1 CVE-2016-9252 K46535047 Improper handling of IP options
596340-3 CVE-2016-9244 K05121675 F5 TLS vulnerability CVE-2016-9244
591329-2 CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109 K36488941 CVE-2016-2108 fixed in Oracle Access Manager library used by BIG-IP APM
588496-3 CVE-2009-3555 K10737 SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
586131-3 CVE-2014-3566 K15702 SSLv3 vulnerability CVE-2014-3566
580026-3 CVE-2017-6165 K74759095 HSM logging error
635412-2 CVE-2017-6137 K82851041 Invalid mss with fast flow forwarding and software syn cookies
618261-3 CVE-2016-2182 K01276005 OpenSSL vulnerability CVE-2016-2182
604442-1 CVE-2016-6249 K12685114 iControl log
597023-4 CVE-2016-4954 K82644737 NTP vulnerability CVE-2016-4954
594496-3 CVE-2016-4539 K35240323 PHP Vulnerability CVE-2016-4539
591455-2 CVE-2016-1550 CVE-2016-1548 CVE-2016-2516 CVE-2016-2518 K24613253 NTP vulnerability CVE-2016-2516
591447-3 CVE-2016-4070 K42065024 PHP vulnerability CVE-2016-4070
520924-4 CVE-2016-5020 K00265182 Restricted roles for custom monitor creation
475743-4 CVE-2017-6128 K92140924 Improve administrative login efficiency
635933-1 CVE-2004-0790 K23440942 K13361021 The validation of ICMP messages for ePVA accelerated TCP connections needs to be configurable
600198-4 CVE-2016-2178 CVE-2016-6306 CVE-2016-6302 K53084033 OpenSSL vulnerability CVE-2016-2178
599285-4 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 K51390683 PHP vulnerabilities CVE-2016-5094 and CVE-2016-5095
597010-4 CVE-2016-4955 K03331206 NTP vulnerability CVE-2016-4955
596997-4 CVE-2016-4956 K64505405 NTP vulnerability CVE-2016-4956
591767-3 CVE-2016-1547 K11251130 NTP vulnerability CVE-2016-1547
573343-3 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8158 K01324833 NTP vulnerability CVE-2015-8158


Functional Change Fixes

ID Number Severity Solution Article(s) Description
620712-1 3-Major   Added better search capabilities on the Pool Members Manage & Pool Create page.
599536-2 3-Major   IPsec peer with wildcard selector brings up wrong phase2 SAs
581840 3-Major   Cannot manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.
564876-1 3-Major   New DB variable log.lsn.comma changes CGNAT logs to CSV format
561348-4 3-Major   krb5.conf file is not synchronized between blades and not backed up
541549-4 3-Major   AWS AMIs for BIG-IP VE will now have volumes set to be deleted upon instance termination.
530109-5 3-Major   OCSP Agent does not honor the AIA setting in the client cert even though 'Ignore AIA' option is disabled.
454492-1 3-Major   Improved handling of signature_algorithms extension to avoid using SHA1 in TLS handshake signatures
451433-7 3-Major   HA group combined with other failover (e.g., VLAN Failsafe or Gateway Failsafe)
609084-1 4-Minor   Max number of chunks not configurable above 1000 chunks
591733-2 4-Minor K83175883 Save on Auto-Sync is missing from the configuration utility.


TMOS Fixes

ID Number Severity Solution Article(s) Description
624263-3 2-Critical   iControl REST API sets non-default profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets profile's non-default property value as "none"; properties missing in iControl REST API response
624245 2-Critical   Hung tasks leading to system problems and lack of management access via ssh/GUI
614865-2 2-Critical   Overwrite flag in iControl functions key/certificate_import_from_pem functions is ignored and might result in errors.
613536-2 2-Critical   tmm core while running the iRule STATS:: command
605476-2 2-Critical   istatsd can core when reading corrupt stats files.
601527-3 2-Critical   mcpd memory leak and core
591104-3 2-Critical   ospfd cores due to an incorrect debug statement.
587698-2 2-Critical   bgpd crashes when ip extcommunity-list standard with route target(rt) and Site-of-origin (soo) parameters are configured
583516-3 2-Critical   tmm ASSERT's "valid node" on Active, after timer fire..
574055-3 2-Critical   TMM crash after changing raccoon log level
570881-4 2-Critical   IPsec configuration mismatch in IKEv2 causes TMM crash in isakmp_parse_proposal ()
570663-3 2-Critical   Using iControl get_certificate_bundle_v2 causes a memory leak
570419-2 2-Critical   Use of session DB on multi-process appliances and blades may core.
567457-3 2-Critical   TMM may crash when changing the IKE peer config.
460833-1 2-Critical   MCPD sync errors and restart after multiple modifications to file object in chassis
457252-1 2-Critical   tmm crash when using sip_info persistence without a sip profile
440752-1 2-Critical   qkview might loop writing output file if MCPD fails during execution
355806-3 2-Critical   Starting mcpd manually at the command line interferes with running mcpd
623401-4 3-Major   Intermittent OCSP request failures due to non-optimal default TCP profile setting
621417-1 3-Major   sys-icheck error for /usr/share/defaults/bigip_base.conf in AWS.
621242 3-Major   Reserve enough space in the image for future upgrades.
616242-2 3-Major K39944245 basic_string::compare error in encrypted SSL key file if the first line of the file is blank
615934-2 3-Major   Overwrite flag in various iControl key/certificate management functions is ignored and might result in errors.
609119-5 3-Major   Occasionally the logging system prints out a blank message: err mcpd[19114]: 01070711:3:
608320-4 3-Major   iControl REST API sets non-default persistence profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets persistence profile's non-default property value as "none"; properties missing in iControl REST API response
604931-1 3-Major K42028295 bgpd might core on restarting process with BGP debug enabled.
603149-1 3-Major   Large ike-phase2-lifetime-kilobytes values in racoon ipsec-policy
601502-1 3-Major   Excessive OCSP traffic
600558-3 3-Major   Errors logged after deleting user in GUI
597729-1 3-Major   Errors logged after deleting user in GUI
597601-4 3-Major   Improvement for a previous issue regressed NAT-T
596814-3 3-Major   HA Failover fails in certain valid AWS configurations
592870-3 3-Major   Fast successive MTU changes to IPsec tunnel interface crashes TMM
590904-5 3-Major   New HA Pair created using serial cable failover only will remain Active/Active
586878-2 3-Major   During upgrade, configuration fails to load due to clientssl profile with empty cert/key configuration.
585485-4 3-Major   inter-ability with "delete IPSEC-SA" between AZURE, ASA, and the BIG-IP system
583285-7 3-Major   BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.
577440-1 3-Major   audit logs may show connection to hagel.mnet
571344-3 3-Major   SSL Certificate with special characters might cause exception when GUI retrieves items list page.
566507-2 3-Major   Wrong advertised next-hop in BGP for a traffic group in Active-Active deployment
560510-6 3-Major   Invalid /etc/resolv.conf when more than one DNS servers are set and MCPD is down.
557059-2 3-Major   When a virtual server has an Anti-Fraud Profile and a Web Acceleration profile, POST requests to non-protected URLs hang
543208 3-Major K40670213 Upgrading v11.6.0 to v12.x in a sync-failover group might cause mcpd to become unresponsive.
534021-5 3-Major   HA on AWS uses default AWS endpoint (EC2_URL).
533813-3 3-Major   Internal Virtual Server in partition fails to load from saved config
528498-5 3-Major   Recently-manufactured hardware may not be identified with the correct model name and SNMP OID
523642-5 3-Major   Power Supply status reported incorrectly after LBH reset
523527-6 3-Major K43121346 Upgrade from 10.x to 11.2.0 or later does not add existing routing protocols to RD0.
516540-3 3-Major   devmgmtd file object leak
509400-1 3-Major K36089384 vCMP VIPRION: internal flooded unicast packets with multi-slot trunks impact performance
502714-4 3-Major K75031635 Deleting files and file object references in a single transaction might cause validation errors
481089-7 3-Major   Request group incorrectly deleted prior to being processed
479660-2 3-Major   tmm crash in ipsec when ipsec-policy and ike-peer do not match.
460176-4 3-Major   Hardwired failover asserts active even when standalone
400456-3 3-Major   HTTP monitors with long send or receive strings may not save or update
339825-3 3-Major   Management.KeyCertificate.install_certificate_from_file failing silently
598498-4 4-Minor   Cannot remove Self IP when an unrelated static ARP entry exists.
585097-3 4-Minor   Traffic Group score formula does not result in unique values.
581835-3 4-Minor   Command failing: tmsh show ltm virtual vs_name detail.
551208-1 4-Minor   Nokia alarms are not deleted due to the outdated alert_nokia.conf.
542347-1 4-Minor   Denied message in audit log on first time boot
541320-6 4-Minor K50973424 Sync of tunnels might cause restore of deleted tunnels.
535544-5 4-Minor   Enhancement: ltm virtual translate-port, translate-address are not listed if they are enabled
477700-1 4-Minor K04116117 Detail missing from power supply 'Bad' status log messages
470627-2 5-Cosmetic   Incorrect and benign log message of bandwidth utilization exceeded when licensed with rate limit in VE
442231-2 5-Cosmetic   Pendsect log entries have an unexpected severity


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
622166 2-Critical   HTTP GET requests with HTTP::cookie iRule command receive no response
619528-2 2-Critical   TMM may accumulate internal events resulting in TMM restart
616215-2 2-Critical   TMM can core when using LB::detach and TCP::notify commands in an iRule
613088-1 2-Critical   pkcs11d thread has session initialization problem.
612229-2 2-Critical   TMM may crash if LTM a disable policy action for 'LTM Policy' is not last
607360-2 2-Critical   Safenet 6.2 library missing after upgrade
605865-2 2-Critical   Debug TMM produces core on certain ICMP PMTUD packets
604223-1 2-Critical   pkcs11d signal handler improvement to turn off all threads at time of "SIGTERM"
603082-2 2-Critical   Ephemeral pool members are getting deleted/created over and over again.
603032-2 2-Critical   clientssl profiles with sni-default enabled may leak X509 objects
597966 2-Critical   ARP/neighbor cache nexthop object can be freed while still referenced by another structure
588351-2 2-Critical   IPv6 fragments are dropped when packet filtering is enabled.
574153-2 2-Critical   If an SSL client disconnects while data is being sent to SSL client, the connection may stall until TCP timeout.
526367-3 2-Critical   tmm crash
509646-7 2-Critical   Occasional connections reset when using persistence
480009-2 2-Critical   OSPFv2 Redistributed routes are deleted after blade failover with Graceful Restart
624616-3 3-Major   Safenet uninstall is unable to remove libgem.so
618517-2 3-Major   bigd may falsely complain of a file descriptor leak when it cannot open its debug log file
617862-1 3-Major   Fastl4 handshake timeout is absolute instead of relative
617858-1 3-Major   bigd core when using Tcl monitors
617824-2 3-Major   "SSL::disable/enable serverside" + oneconnect reuse is broken
613673-1 3-Major K48693281 Pool members may not be marked up and/or there might be a slight delay in monitors
610609-1 3-Major   Total connections in bigtop, SNMP are incorrect
610429-3 3-Major   X509::cert_fields iRule command may memory with subpubkey argument
607304-2 3-Major   TMM is killed by SOD (missing heartbeat) during geoip_reload performing munmap.
606575-3 3-Major   Request-oriented OneConnect load balancing ends when the server returns an error status code.
604977-3 3-Major K08905542 Wrong alert when DTLS cookie size is 32
603606 3-Major   tmm core
603236-2 3-Major   1024 and 4096 size key creation issue with SafeNet 6.2 with 6.10.9 firmware
602366-2 3-Major   Safenet 6.2 HA performance
602358-2 3-Major   BIG-IP ServerSSL connection may reset during rengotiation with some SSL/TLS servers due to ClientHello version
601496-1 3-Major   iRules and OCSP Stapling
601178-3 3-Major   HTTP cookie persistence 'preferred' encryption
600827-5 3-Major   Stuck nitrox crypto queue can erroneously be reported
600593-4 3-Major   Use of HTTP Explicit Proxy and OneConnect can lead to an issue with CONNECT HTTP requests
598874-3 3-Major   GTM Resolver sends FIN after SYN retransmission timeout
595275-2 3-Major   Virtual IP address change might cause VIP state to go from GREEN to RED to GREEN
594642-1 3-Major   Stream filter may require large allocations by Tcl leading TMM to core on allocation failure.
592871-2 3-Major   Cavium Nitrox PX/III stuck queue diagnostics missing.
592497-2 3-Major   Idle timeout ineffective for FIN_WAIT_2 when server-side expired and HTTP in fallback state.
591789-1 3-Major   IPv4 fragments are dropped when packet filtering is enabled.
591659-3 3-Major K47203554 Server shutdown is propagated to client after X-Cnection: close transformation.
591476-8 3-Major K53220379 Stuck crypto queue can erroneously be reported
591343-2 3-Major   SSL::sessionid output is not consistent with the sessionid field of ServerHello message.
588115-3 3-Major   TMM may crash with traffic to floating self-ip in range overlapping route via unreachable gw
586738-2 3-Major   The tmm might crash with a segfault.
584029-2 3-Major   Fragmented packets may cause tmm to core under heavy load
578971-1 3-Major   When mcpd is restarted on a blade, cluster members may be temporarily marked as failed
576224-1 3-Major   NetHSM does not come back after TCP connection to device is reset
573402-2 3-Major   "C_GetAttributeValue error" with netHSM
572281-2 3-Major   Variable value in the nesting script of foreach command get reset when there is parking command in the script
571573-2 3-Major K20320811 Persistence may override node/pmbr connection limit
570057-3 3-Major   Can't install more than 16 SafeNet HSMs in its HA group
569642-4 3-Major   Deleting all routes on a unit with a mirroring fastL4 Virtual may cause TMM to core
569288-2 3-Major   Different LACP key may be used in different blades in a chassis system causing trunking failures
569206-2 3-Major K47952434 After connectivity loss and restoration between HSM and pkcs11d, SSL fails on some blades.
568743-3 3-Major   TMM core when dnssec queries to dns-express zone exceed nethsm capacity
568543-3 3-Major   Syncookie mode is activated on wildcard virtuals
567862-1 3-Major   intermittent SSL traffic failure with Safenet HSM on BIG-IP chassis and appliance
565799-2 3-Major   CPU Usage increases when using masquerade addresses
563227-3 3-Major K31104342 When a pool member goes down, persistence entries may vary among tmms
557358-1 3-Major   TMM SIGSEGV and crash when memory allocation fails.
556117-2 3-Major   client-ssl profile is case-sensitive when checking server_name extension
555432-1 3-Major   Large configuration files may go missing on secondary blades
550669-1 3-Major K06263705 Monitors stop working - throttling monitor instance probe because file descriptor limit 65436 reached
549329-1 3-Major K02020031 L7 mirrored ACK from standby to active box can cause tmm core on active
545450-3 3-Major   Log activation/deactivation of TM.TCPMemoryPressure
541126-4 3-Major   Safenet connection may fail on restarting pkcs11d or HSM reboot or if the connection to HSM is lost and then resumed
537553-6 3-Major   tmm might crash after modifying virtual server SSL profiles in SNI configuration
528736-1 3-Major   When tcp connection is aborting tmm can crash with "hud_oob consumed" message
525675 3-Major   SSL with forward proxy can leak memory
522310-3 3-Major   ICMP errors cause the associated FastL4/TCP connection to be reset
519746-1 3-Major   ICMP errors may reset FastL4 connections unexpectedly
518086-6 3-Major   Safenet HSM Traffic failure after system reboot/switchover
505705-7 3-Major   Expired mirrored persistence entries not always freed using intra-chassis mirroring
501984-2 3-Major   TMM may experience an outage when an iRule fails in LB_SELECTED.
500003-4 3-Major   Incoming NTP packets from configured NTP server to non-local IP breaks outgoing NTP
494977-2 3-Major   Rare outages possible when using config sync and node-based load balancing
490740-10 3-Major   TMM may assert if HTTP is disabled by another filter while it is parked
475677-3 3-Major   Connections may hang until timeout if a LTM policy action failed
464801-2 3-Major   Intermittent tmm core
442539-1 3-Major   OneConnect security improvements.
587966-3 4-Minor K77283304 LTM FastL4 DNS virtual server: first A query dropped when A and AAAA requested at the same time with same source IP:port
574020-4 4-Minor   Safenet HSM installation script fails to install successfully if partition password contains special metacharacters (!#{}')
538708-3 4-Minor   TMM may apply SYN cookie validation to packets before generating any SYN cookies
513288-5 4-Minor   Management traffic from nodes being health monitored might cause health monitors to fail.
499795-2 4-Minor   "persist add" in server-side iRule event can result in "Client Addr" being pool member address
446830-3 4-Minor   Current Sessions stat does not increment/decrement correctly.


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
603598-2 2-Critical   big3d memory under extreme load conditions
587656-3 2-Critical   GTM auto discovery problem with EHF for ID574052
587617-3 2-Critical   While adding GTM server, failure to configure new IP on existing server leads to gtmd core
613576-2 3-Major   QOS load balancing links display as gray
613045 3-Major   Interaction between GTM and 10.x LTM results in some virtual servers marked down
601180-1 3-Major K73505027 Link Controller base license does not allow DNS namespace iRule commands.
589256-3 3-Major   DNSSEC NSEC3 records with different type bitmap for same name.
588289-4 3-Major   GTM is Re-ordering pools when adding pool including order designation
574052-2 3-Major   GTM autoconf can cause high CPU usage for gtmd


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
634001-1 2-Critical   ASM restarts after deleting a VS that has an ASM security policy assigned to it
582003-2 2-Critical   BD crash on startup or on XML configuration change
515728-5 2-Critical   Repeated BD cores.
514571-1 2-Critical   Apply policy operation hangs
511187-1 2-Critical   The BIG-IP ASM bd process may produce a core file when a large BIG-IP ASM configuration is modified on a loaded system
499347-3 2-Critical   JSON UTF16 content could be blocked by ASM as Malformed JSON
621524-3 3-Major   Processing Timeout When Viewing a Request with 300+ Violations
605921 3-Major   scriptd and mcpd cores following multiple failovers due to bd (asm)
605616-3 3-Major K16221342 Creating 256 Fundamental Security policies will result in an out of memory error
603945-1 3-Major   BD config update should be considered as config addition in case of update failure
603479-1 3-Major   "ASM starting" while it's already running, causing the restart of all ASM daemons
602221-3 3-Major   Wrong parsing of redirect Domain
600174-1 3-Major   Wildcard "*" redirection domain cannot be deleted if list is scrollable
582683-5 3-Major   xpath parser doesn't reset a namespace hash value between each and every scan
580168-2 3-Major   Information missing from ASM event logs after a switchboot and switchboot back
576591-4 3-Major   Support for some future credit card number ranges
573406-3 3-Major   ASU cannot be completed if license was last activated more than 18 months before
559541-2 3-Major   ICAP anti virus tests are not initiated on XML with when should
553976-1 3-Major   AJAX File uploads don't work in IE (import policy doesn't work)
528071-1 3-Major   ASM periodic updates (cron) write errors to log
521204-1 3-Major   Include default values in XML Policy Export
508957-1 3-Major   ASM REST Slowness Viewing Policy List
392121-1 3-Major   TMSH Command to retrieve the memory consumption of the bd process
609496-1 4-Minor   Improved diagnostics in BD config update (bd_agent) added
603071-1 4-Minor   XHTML validation fails on obfuscated JavaScript
471766-2 4-Minor   Number of decoding passes configuration


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
565085-2 3-Major   Analytics profile allows invalid combination of entities for Alerts setup
488989-3 3-Major   AVRD does not print out an error message when the external logging fails
474613-1 3-Major   Upgrading from previous versions


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
622830 2-Critical K20488861 LDAP type CRLDP is parsed incorrectly
622244-1 2-Critical   Edge client can fail to upgrade when always connected is selected
618324-2 2-Critical   Unknown/Undefined OPSWAT ID show up as 'Any' in APM Visual Policy Editor
617310-1 2-Critical   Edge client can fail to upgrade when Always Connected is selected
614322-3 2-Critical K31063537 TMM might crash during handling of RDG-RPC connection when APM is used as RD Gateway
608408-4 2-Critical   TMM may restart if SSO plugin configuration initialization fails due to internal error in tmconf library
582440-2 2-Critical   Linux client does not restore route to the default GW on Ubuntu 15.10
625376-1 3-Major   In some cases, download of PAC file by edge client may fail
623562-1 3-Major   Large POSTs rejected after policy already completed
621202-1 3-Major   Portal Access: document.write() with very long string as argument may be handled incorrectly.
620614-2 3-Major   Citrix PNAgent replacement mode: iOS Citrix receiver fails to add new store account
619879-3 3-Major   HTTP iRule commands could lead to WEBSSO plugin being invoked
617316-1 3-Major   Desktop title is garbled for Citrix Storefront integration mode with non-sta configuration
617002-3 3-Major   SWG with Response Analytics agent in a Per-Request policy fails with some URLs
616838 3-Major   Citrix Remote desktop resource custom parameter name does not accept hyphen character
614891-4 3-Major   Routing table doesn't get updated when EDGE client roams among wireless networks
613613-1 3-Major   Incorrect handling of form that contains a tag with id=action
612419-2 3-Major   APM 11.4.1 HF10 - suspected memory leak (umem_alloc_32/network access (variable))
611669-1 3-Major   Mac Edge Client customization is not applied on macOS 10.12 Sierra
610248 3-Major   IE 11 browser does not display VDI profile columns properly
610243 3-Major   HTML5 access fails for Citrix Storefront integration mode with gateway pass through authentication
610224-1 3-Major   APM client may fetch expired certificate when a valid and an expired certificate co-exist
610180-3 3-Major   SAML Single Logout is misconfigured can cause a minor memory leak in SSO plugin.
604767-4 3-Major   Importing SAML IdP's metadata on BIG-IP as SP may result in not complete configuration of IdP connector object.
603293-3 3-Major   Incorrect handling of L4 Dynamic ACL when it is processed together with L7 ACLs
601905-4 3-Major   POST requests may not be forwarded to backend server when EAM plugin is enabled on the virtual server
600116-1 3-Major   DNS resolution request may take a long time in some cases
598211-2 3-Major   Citrix Android Receiver 3.9 does not work through APM in StoreFront integration mode.
591268-3 3-Major   VS hostname is not resolvable when DNS Relay proxy is installed and running under certain conditions
583113-3 3-Major   NTLM Auth cannot be disabled in HTTP_PROXY_REQUEST event
582752-2 3-Major   Macrocall could be topologically not connected with the rest of policy.
569309-1 3-Major   Clientside HTML parser does not recognize HTML event attributes without value
567503-5 3-Major K03293396 ACCESS::remove can result in confusing ERR_NOT_FOUND logs
566998-2 3-Major   Edge client upgrade fails if client was configured in locked mode
559082-1 3-Major   Tunnel details are not shown for MAC Edge client
554458 3-Major   No Session Variables displayed when click on "View Session Variables" link in APM "All Sessions" reports with reduced zeros in Session ID
509595-1 3-Major   Start uri is blank when going through portal in ie, but loads fine in firefox
451301-1 3-Major   HTTP iRules break Citrix HTML5 functionality
389484-4 3-Major   OAM reporting Access Server down with JDK version 1.6.0_27 or later
366149-1 3-Major   ACL support for VPN tunnels
238444-2 3-Major   An L4 ACL has no effect when a layered virtual server is used.
620922-1 4-Minor   Online help for Network Access needs update


WebAccelerator Fixes

ID Number Severity Solution Article(s) Description
472942-2 2-Critical K04924125 tmm crash while changing acceleration policy
596569-2 3-Major   Memory leak on Central device in Symmetric deployment
506315-5 3-Major   WAM/AAM is honoring OWS age header when not honoring OWS maxage.
474445-2 3-Major   TMM crash when processing unexpected HTTP response in WAM


Wan Optimization Manager Fixes

ID Number Severity Solution Article(s) Description
619757-3 2-Critical   iSession causes routing entry to be prematurely freed


Service Provider Fixes

ID Number Severity Solution Article(s) Description
607713-4 3-Major   SIP Parser fails header with multiple sequential separators inside quoted string.
601255-3 3-Major   RTSP response to SETUP request has incorrect client_port attribute
599521-2 3-Major   Persistence entries not added if message is routed via an iRule
598854-1 3-Major   sipdb tool incorrectly displays persistence records without a pool name
597835-1 3-Major   Branch parameter in inserted VIA header not consistent as per spec
583010-9 3-Major   Sending a SIP invite with "tel" URI fails with a reset


Advanced Firewall Manager Fixes

ID Number Severity Solution Article(s) Description
619710 3-Major   GUI gives error when clicking "Update" making changes to VS in Security-Policies
618902-3 3-Major   PCCD memory usage increases on configuration changes and recompilation due to small amount of memory leak on each compilation
614563-1 3-Major   AVR TPS calculation is inaccurate
605427-2 3-Major   TMM may crash when adding and removing virtual servers with security log profiles
592113-1 3-Major   tmm core on the standby unit with dos vectors configured
580460-1 3-Major   Client side integrity defense or proactive may break application
495390-4 3-Major   An error occurs on Active Rules page after attempting to reorder Rules in a Policy


Policy Enforcement Manager Fixes

ID Number Severity Solution Article(s) Description
553735-3 2-Critical   TMM core on HTTP response with steering action .
527992-2 2-Critical   tmm might crash with 'DHCP:dhcp_server_flow_connect' error when the server flow is already connected to a different client.
624091 3-Major   DHCP relay is not forwarding all of the DHCPOFFERS to clients
611355 3-Major   tmm core with PEM
608742-4 3-Major   DHCP: DHCP renew ack messages from server are getting dropped by BIGIP in Forward mode.
592070-1 3-Major   DHCP server connFlow when created based on the DHCP client connFlow does not have the traffic group ID copied
551303-3 3-Major K75280116 TMM may core during processing of a CCA-T.
472122-4 3-Major   DHCPv4: When configured in forwarding mode, BIG-IP will support client messages that use either UDP 67 or 68 as the source port.


Carrier-Grade NAT Fixes

ID Number Severity Solution Article(s) Description
532365-1 3-Major   lsndb cores with "Assertion `size < bin_key_size' failed"
504828-2 3-Major   "translate address" and "translate port" are enabled by default when configure from GUI
481948-1 3-Major   LSN_DELETE messages may not be logged in PBA mode


Global Traffic Manager (DNS) Fixes

ID Number Severity Solution Article(s) Description
621239-1 3-Major   Certain DNS queries bypass DNS Cache RPZ filter.
620215-3 3-Major   TMM out of memory causes core in DNS cache
619398-4 3-Major   TMM out of memory causes core in DNS cache
491801 3-Major   GTM iRule command [LB::status up] gives error
615187-1 4-Minor   Missing hyperlink to GSLB virtual servers and servers on the pool member page.


Traffic Classification Engine Fixes

ID Number Severity Solution Article(s) Description
615260 2-Critical   out of memory condition when URL categorization is configured to work with large feedlists


Device Management Fixes

ID Number Severity Solution Article(s) Description
522268-2 2-Critical   hostagentd memory leak on VCMP hosts



Cumulative fixes from BIG-IP v11.6.1 Hotfix 1 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
596488-4 CVE-2016-5118 K82747025 GraphicsMagick vulnerability CVE-2016-5118.
591806-3 CVE-2016-3714 K03151140 ImageMagick vulnerability CVE-2016-3714
591328-2 CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109 K36488941 OpenSSL vulnerability CVE-2016-2106
591327-2 CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109 K36488941 OpenSSL vulnerability CVE-2016-2106
591325-2 CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109 K75152412 OpenSSL (May 2016) CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109
591042-5 CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109 K23230229 OpenSSL vulnerabilities
579955-2 CVE-2016-7475 K01587042 BIG-IP SPDY and HTTP/2 profile vulnerability CVE-2016-7475
577826-4 CVE-2016-1286 K62012529 BIND vulnerability CVE-2016-1286
573778-7 CVE-2016-1714 K75248350 QEMU vulnerability CVE-2016-1714
573124-2 CVE-2016-5022 K06045217 TMM vulnerability CVE-2016-5022
563670-11 CVE-2015-3194, CVE-2015-3195, CVE-2015-3196 K86772626 OpenSSL vulnerabilities
601938-3 CVE-2016-7474 K52180214 MCPD stores certain data incorrectly
593447-2 CVE-2016-5024 K92859602 BIG-IP TMM iRules vulnerability CVE-2016-5024
591918-4 CVE-2016-3718 K61974123 ImageMagick vulnerability CVE-2016-3718
591908-4 CVE-2016-3717 K29154575 ImageMagick vulnerability CVE-2016-3717
591894-4 CVE-2016-3715 K10550253 ImageMagick vulnerability CVE-2016-3715
591881-4 CVE-2016-3716 K25102203 ImageMagick vulnerability CVE-2016-3716
587077-3 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2115 CVE-2016-2118 K37603172 Samba vulnerabilities CVE-2015-5370 and CVE-2016-2118
585424-3 CVE-2016-1979 K20145801 Mozilla NSS vulnerability CVE-2016-1979
582813-1 CVE-2016-0774 K08440897 Linux Kernel CVE-2016-0774
579220-3 CVE-2016-1950 K91100352 Mozilla NSS vulnerability CVE-2016-1950
564111-1 CVE-2015-8395 CVE-2015-8384 CVE-2015-8392 CVE-2015-8394 CVE-2015-8391 CVE-2015-8390 CVE-2015-8389 CVE-2015-8388 CVE-2015-8387 CVE-2015-8386 CVE-2015-8385 CVE-2015-8383 CVE-2015-8382 CVE-2015-8381 CVE-2015-8380 CVE-2015-2328 CVE-2015-2327 CVE-2015-8393 K05428062 Multiple PCRE vulnerabilities
541231-2 CVE-2014-3613 CVE-2014-3707 CVE-2014-8150 CVE-2015-3143 CVE-2015-3148 K16704 K16707 Resolution of multiple curl vulnerabilities
486791-2 CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6425 CVE-2014-6426 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 K16939 Resolution of multiple wireshark vulnerabilities
416734-1 CVE-2012-5195 CVE-2012-5526 CVE-2012-6329 CVE-2013-1667 K15867 Multiple Perl Vulnerabilities
580340-3 CVE-2016-2842 K52349521 OpenSSL vulnerability CVE-2016-2842
580313-3 CVE-2016-0799 K22334603 OpenSSL vulnerability CVE-2016-0799
579975-3 CVE-2016-0702 K79215841 OpenSSL vulnerability
579829-3 CVE-2016-0702 K79215841 OpenSSL vulnerability CVE-2016-0702
579237-3 CVE-2016-0705 K93122894 OpenSSL Vulnerability CVE-2016-0705
579085-4 CVE-2016-0797 K40524634 OpenSSL vulnerability CVE-2016-0797
578570-2 CVE-2016-0705 K93122894 OpenSSL Vulnerability CVE-2016-0705
577828-5 CVE-2016-2088 K59692558 BIND vulnerability CVE-2016-2088
577823-4 CVE-2016-1285 K46264120 BIND vulnerability CVE-2016-1285
567379-1 CVE-2013-4397 K16015326 libtar vulnerability CVE-2013-4397
565895-4 CVE-2015-3217 K17235 Multiple PCRE Vulnerabilities
553454-2 CVE-2015-2730 K15955144 Mozilla NSS vulnerability CVE-2015-2730
551287-4 CVE-2010-2596 CVE-2013-1960 CVE-2013-1961 CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 K16715 Multiple LibTIFF vulnerabilities
481806-2 CVE-2013-4002 K16872 Java Runtime Environment vulnerability CVE-2013-4002
479431-4 CVE-2014-3596 K16821 Apache Axis vulnerability CVE-2014-3596
416372-4 CVE-2012-2677 K16946 Boost memory allocator vulnerability CVE-2012-2677
570667-16 CVE-2016-0701 CVE-2015-3197 K64009378 OpenSSL vulnerabilities
517048-1 CVE-2015-2305 K16831 BSD regex library vulnerability CVE-2015-2305


Functional Change Fixes

ID Number Severity Solution Article(s) Description
532685-6 3-Major   PAC file download errors disconnect the tunnel
544325-3 4-Minor K83161025 BIG-IP UDP virtual server may not send ICMP Destination Unreachable message Code 3 (port unreachable).
483508-1 4-Minor K70333230 Large values may display as negative numbers for 32-bit integer variables in the MIB


TMOS Fixes

ID Number Severity Solution Article(s) Description
538761-4 1-Blocking   scriptd may core when MCP connection is lost
583936-3 2-Critical   Removing ECMP route from BGP does not clear route from NSM
574116-2 2-Critical   MCP may crash when syncing configuration between device groups
570973-2 2-Critical   L7 hardware syn cookie feature is broken in BIG-IP v12.0.0 hf1 and hf2
569634 2-Critical   Aced process is not able to listen to port 6000
568889-2 2-Critical K22989000 Some ZebOS daemons do not start on blade transition secondary to primary.
563064-1 2-Critical   Bringing up and tearing down an IPsec tunnel will slowly leak tmm memory
561814-1 2-Critical   TMM Core on Multi-Blade Chassis
560683-3 2-Critical   HA IPSEC: tmm core/crash on standby in function ikev2_child_delete_outbound()
559034-1 2-Critical   Mcpd core dump in the sync secondary during config sync
557144-3 2-Critical   Dynamic route flapping may lead to tmm crash
542097-2 2-Critical   Update to RHEL6 kernel
530903-1 2-Critical   HA pair in a typical Active/Standby configuration becomes Active/Active after a software upgrade
529141-5 2-Critical K95285012 Upgrade from 10.x fails on valid clientssl profile with BIGpipe parsing error
506274-2 2-Critical   TMM crash/core seen when a traffic-selector is created Action discard
493053-2 2-Critical   Route domains' firewall policies may be removed after sync
481647-5 2-Critical   OSPF daemon asserts and generates core
477611-4 2-Critical   ICMP monitor does not work on DAG Round Robin enabled VLANs
473527-2 2-Critical   IPsec interop problem when using AES-GCM.
420438-3 2-Critical   Default routes from standby system when HA is configured in NSSA
598039-3 3-Major   MCP memory may leak when performing a wildcard query
595773-3 3-Major   Cancellation requests for chunked stats queries do not propagate to secondary blades
579284 3-Major   Potential memory corruption in MCPd
576305-3 3-Major   Potential MCPd leak in IPSEC SPD stats query code
575735-2 3-Major   Potential MCPd leak in global CPU info stats code
575726-2 3-Major   MCPd might leak memory in vCMP interface stats.
575716-2 3-Major   MCPd might leak memory in VCMP base stats.
575708-2 3-Major   MCPd might leak memory in CPU info stats.
575671-2 3-Major   MCPd might leak memory in host info stats.
575660-2 3-Major K50219995 Potential MCPd leak in TMM rollup stats stats
575649-2 3-Major   MCPd might leak memory in IPFIX destination stats query
575619-2 3-Major   Potential MCPd leak in pool member stats query code
575608-2 3-Major   MCPd might leak memory in virtual server stats query.
575595-1 3-Major   Potential MCPd leak in eviction policy stats.
575591-2 3-Major   Potential MCPd leak in IKE message stats query code
575589-1 3-Major   Potential MCPd leak in IKE event stats query code
575587-2 3-Major   Potential MCPd leak in BWC policy class stats query code
575027-2 3-Major   Tagged VLAN configurations with a cmp-hash setting for the VLAN, might result in performance issues.
574045-2 3-Major   BGP may not accept attributes using extended length
571210-4 3-Major   Upgrade, load config, or sync might fail on large configs with large objects.
571019-3 3-Major   Topology records can be ordered incorrectly.
570818-2 3-Major   Address lease-pool in IKEv2 might interfere with IKEv2 negotiations.
570053-2 3-Major K78448635 HA peer's certkeychain of clientssl profile is unexpectedly either removed or re-named after config sync.
569356-2 3-Major K91428939 BGP ECMP learned routes may use incorrect VLAN for nexthop
569236-4 3-Major   BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.
565534-2 3-Major K40254066 Some failover configuration items may fail to take effect
562044-2 3-Major   Statistics slow_merge option does not work
559939-2 3-Major K30040319 Changing hostname on host sometimes causes blade to go RED / HA TABLE offline
558858-4 3-Major K80079953 Unexpected loss of communication between slots of a vCMP Guest
558779-6 3-Major   SNMP dot3 stats occassionally unavailable
557281-2 3-Major   The audit_forwarder process fails to exit normally causing the process to consume CPU to near 100%
555039-2 3-Major K24458124 VIPRION B2100: Increase egress traffic burst tolerance for dual CoS queue configuration
553795-4 3-Major   Differing certificate/key after successful config-sync
549971-5 3-Major   Some changes to virtual servers' profile lists may cause secondary blades to restart
548385-3 3-Major K25231211 iControl calls that query key/cert from parent folder, and the name is missing the extension, result in incorrect results
546410-2 3-Major K02151433 Configuration may fail to load when upgrading from version 10.x.
545745-2 3-Major   Enabling tmm.verbose mode produces messages that can be mistaken for errors.
542860-4 3-Major   TMM crashes when IPsec SA are deleted during HA Active to Standby or vice versa event
542742-2 3-Major K07038540 SNMP reports invalid data from global_stat, avg server-side cur_conns (for 5s, 1m, 5m).
542320-1 3-Major   no login name may appear when running ssh commands through management port
541316-3 3-Major K41175594 Unexpected transition from Forced Offline to Standby to Active
539199-3 3-Major   HTML filter is truncating the server response when sending it to client
538133-4 3-Major   Only one action per sensor is displayed in sensor_limit_table and system_check
537326-2 3-Major   NAT available in DNS section but config load fails with standalone license
532559-4 3-Major   Upgrade fails to 11.5.0 and later if 'defaults-from none' is under profile '/Common/clientssl'.
526974-1 3-Major   Data-group member records map empty strings to 'none'.
521270-2 3-Major   Hypervisor might replace vCMP guest SYN-Cookie secrets
519081-1 3-Major   Cannot use tmsh to load valid configuration created using the GUI.
516995-3 3-Major   NAT traffic group inheritance does not sync across devices
513649-4 3-Major   Transaction validation errors on object references
512954-2 3-Major   ospf6d might leak memory distribute-list is used
511900-2 3-Major   'sessiondump -allkeys' command hangs
510580-5 3-Major   Interfaces might be re-enabled unexpectedly when loading a partition
508076-2 3-Major   Cannot successfully create a key/cert via tmsh or the GUI of the form name.key1, where extension is in the name.
504803-5 3-Major   GUI Local Traffic Pool list does not show certain Pools with name containing 'mam'.
502049-1 3-Major   Qkview may store information in the wrong format
502048-1 3-Major   Qkview may store information in the wrong format
487625-3 3-Major   Qkview might hang
486725-2 3-Major   GUI creating key files with .key extensions in the name causing errors
486712-3 3-Major   GUI PVA connection maximum statistic is always zero
485702-4 3-Major   Default SNMP community 'public' is re-added after the upgrade
484534-4 3-Major   interface STP state stays in blocked when added to STP as disabled
481696-2 3-Major   Failover error message 'sod out of shmem' in /var/log/ltm
479553-4 3-Major   Sync may fail after deleting a persistence profile
479543-6 3-Major   Transaction will fail when deleting pool member and related node
478215-2 3-Major   The command 'show ltm pool detail' returns duplicate members in some cases
477888-4 3-Major   ESP ICSA support is non-functional on versions 11.4.0 and up
455651-5 3-Major K40300934 Improper regex/glob validation in web-acceleration and http-compression profiles
451494-2 3-Major   SSL Key/Certificate in different partition with Subject Alternative Name (SAN)
425980-3 3-Major   Blade number not displayed in CPU status alerts
421971-9 3-Major   Renewing certificates with SAN input in the GUI leads to error.
418664-4 3-Major K21485342 Configuration utility CSRF vulnerability
405611-3 3-Major K61045143 Configuration utility CSRF vulnerability
375246-1 3-Major   Clarification of pool member session enabling versus pool member monitor enabling
372118-3 3-Major   import_all_from_archive_file and import_all_from_archive_stream does not create file objects.
601927-3 4-Minor K52180214 Security hardening of control plane
551481-3 4-Minor   'tmsh show net cmetrics' reports bandwidth = 0
536746-3 4-Minor K88051173 LTM : Virtual Address List page uses LTM : Nodes List search filter.
533480-5 4-Minor K43353404 qkview crash
532086-3 4-Minor K68631333 Local Traffic Policy Rules Condition List select value to update with existing values.
478922-3 4-Minor   ICSA logging issues on versions 11.4.0 and later
466612-1 4-Minor   Missing sys DeviceModel OID for VIPRION C2200 chassis
487084-2 5-Cosmetic   GUI iFile delete confirmation page lists incorrect items to be deleted


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
596619 2-Critical K00539510 Some 10.2.x client SSL configurations fail to upgrade to 11.6.1.
579919-1 2-Critical   TMM may core when LSN translation is enabled
575011-4 2-Critical K21137299 Memory leak. Nitrox3 Hang Detected.
565409-4 2-Critical   Invalid MSS with HW syncookies and flow forwarding
559973-2 2-Critical   Nitrox can hang on RSA verification
558612-4 2-Critical   System may fail when syncookie mode is activated
558534-3 2-Critical   The TMM may crash if http url rewrite is used with APM
549868-4 2-Critical K48629034 10G interoperability issues reported following Cisco Nexus switch version upgrade.
534795-1 2-Critical   Swapping VLAN names in config results in switch daemon core and restart.
521548-6 2-Critical   Possible crash in SPDY
517613-1 2-Critical   ClientSSL profile might have the wrong key/certificate/chain when created with a specific set of steps
489217-1 2-Critical   "cipher" memory can leak
488686-1 2-Critical K24980114 Large file transfer hangs when HTTP is in passthrough mode
483665-2 2-Critical   Restrict the permissions for private keys
466007-2 2-Critical   DNS Express daemon, zxfrd, can not start if it's binary cache has filled /var
459671-2 2-Critical   iRules source different procs from different partitions and executes the incorrect proc.
600535 3-Major   TMM may core while exiting if MCPD connection was previously aborted
597089-5 3-Major   Connections are terminated after 5 seconds when using ePVA full acceleration
593530-1 3-Major   In rare cases, connections may fail to expire
592854-4 3-Major   Protocol version set incorrectly on serverssl renegotiation
592784-4 3-Major   Compression stalls, does not recover, and compression facilities cease.
589223-3 3-Major   TMM crash and core dump when processing SSL protocol alert.
588442-3 3-Major   TMM can core in a specific set of conditions.
587892-1 3-Major   Multiple iRule proc names might clash, causing the wrong rule to be executed.
585412-2 3-Major   SMTPS virtual server with activation-mode allow will RST non-TLS connections with Email bodies with very long lines
583957-4 3-Major   The TMM may hang handling pipelined HTTP requests with certain iRule commands.
580303-3 3-Major   When going from active to offline, tmm might send a GARP for a floating address.
579843-3 3-Major   tmrouted may not re-announce routes after a specific succession of failover states
579371-2 3-Major K70126130 BIG-IP may generate ARPs after transition to standby
576296-2 3-Major   MCPd might leak memory in SCTP profile stats query.
575626 3-Major K04672803 Minor memory leak in DNS Express stats error conditions
575612-3 3-Major   Potential MCPd leak in policy action stats query code
575347-2 3-Major   Unexpected backslashes remain in monitor 'username' attribute after upgrade
572025-2 3-Major   HTTP Class profile using a path selector upgrade to a policy that does not match the entire path
571183-2 3-Major   Bundle-certificates Not Accessible via iControl REST.
569349-2 3-Major   Packet's vlan priority is not preserved for CMP redirected flows when net cos feature is enabled
566361-8 3-Major K11543589 RAM Cache Key Collision
563591-2 3-Major   reference to freed loop_nexthop may cause tmm crash.
563419-5 3-Major   IPv6 packets containing extended trailer are dropped
563232-2 3-Major   FQDN pool in resource prevents Access Policy Sync.
554295-3 3-Major   CMP disabled flows are not properly mirrored
551189 3-Major   Modifying an HTTP cookie value via the HTTP::cookie iRule API may yield to incorrect HTTP header data
548583-3 3-Major   TMM crashes on standby device with re-mirrored SIP monitor flows.
547657-1 3-Major   A TCL error in a DNS_RESPONSE iRule event can cause a tmm crash.
545704-2 3-Major   TMM might core when using HTTP::header in a serverside event
543993-3 3-Major   Serverside connections may fail to detach when using the HTTP and OneConnect profiles
540893-2 3-Major   Unevenly loaded tmms while using syncookies may cause occasional spurious connection resets.
540213-2 3-Major   mcpd will continually restart on newly inserted secondary blades when certain configuration exists on the primary
536191-2 3-Major   Transparent inherited TCP monitors may fail on loading configuration
534111-1 3-Major   [SSL] Config sync problems when modifying cert in default client-ssl profile
530812-1 3-Major   Legacy DAG algorithm reuses high source port numbers frequently
530795-3 3-Major   In FastL4 TCP virtual servers, ICMP might send wrong SEQ number/ACK number.
528734-2 3-Major K04711825 TCP keeps retransmitting when ICMP Destination Unreachable-Fragmentation Required messages are received.
527742-4 3-Major K15550890 The inherit-certkeychain field of a clientSSL profile is not synchronized correctly on a standby BIG-IP system
523513-3 3-Major   COMPRESS::enable keeps compression enabled for a subsequent HTTP request.
521711-4 3-Major K14555354 HTTP closes connection if client sends non-keepalive request and server responds with 200 OK on One-Connect enabled virtual
521036-2 3-Major   Dynamic ARP entry may replace a static entry in non-primary TMM instances.
520405-4 3-Major   tmm restart due to oversubscribed DNS resolver
517510-1 3-Major   HTTP monitor might add extra CR/LF pairs to HTTP body when supplied
513530-4 3-Major   Connections might be reset when using SSL::disable and enable command
513319-4 3-Major   Incorrect of failing sideband connections from within iRule may leak memory
504396-2 3-Major   When a virtual's ARP or ICMP is disabled, the wrong mac address is used
503257-7 3-Major   Persistence, connection limits and HTTP::respond or HTTP::redirect may result in RST
502747-1 3-Major   Incoming SYN generates unexpected ACK when connection cannot be recycled
495588-5 3-Major   Configuration fails with Syntax Error after upgrading from pre-11.5.0 releases
490936-2 3-Major   SSLv2/TLSv1 based handshake causing handshake failures
490174-2 3-Major   Improved TLS protocol negotiation with clients supporting TLS1.3
472748-1 3-Major   SNAT pool stats are reflected in global SNAT stats
472571-6 3-Major   Memory leak with multiple client SSL profiles.
468790-2 3-Major   Inconsistent SafeNet key deletion in BIG-IP and Safenet HSM
463202-7 3-Major   BIG-IP system drops non-zero version EDNS requests
623135 4-Minor K68401558 BIG-IP virtual server TCP sequence numbers vulnerability (CVE-2002-1463)
572015-3 4-Minor   HTTP Class profile is upgraded to a case-insensitive policy
532799-2 4-Minor K14551525 Static Link route to /32 pool member can end using dst broadcast MAC
531979-3 4-Minor   SSL version in the record layer of ClientHello is not set to be the lowest supported version.
472051-1 4-Minor   Manually adding username/password in ZebOS can cause imi to core


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
569972-2 2-Critical   Unable to create gtm topology records using iControl REST
569521-4 2-Critical   Invalid WideIP name without dots crashes gtmd.
539466-2 2-Critical   Cannot use self-link URI in iControl REST calls with gtm topology
569472-2 3-Major   TMM segfault in lb_why_pmbr_str after GTM/BIG-IP DNS disables a GTM pool and LB why log is enabled
561539-2 3-Major   [Upgrade] GTM pool member ratio setting to 0 is not honored when upgrading from v10.2.4 to v11.5.3.
559975-5 3-Major   Changing the username or password used for HTTP monitor basic auth may break HTTP basic auth
517582-3 3-Major   [GUI] [GTM] Cannot delete Region if attempting to delete another region referenced by a record.
510888-1 3-Major   [LC] snmp_link monitor is not listed as available when creating link objects


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
578334-3 2-Critical   Policy Import (REST, inline XML import) in HA pair (CMI) fails on the peer device, remaining with a stub (default) policy.
583686-3 3-Major   High ASCII meta-characters can be disallowed on UTF-8 policy via XML import
579524-2 3-Major   DBD::mysql::db do failed: Duplicate entry '/Common/xxx' for key 'name'
577664-2 3-Major   Policy import, to inactive policies list, results in different policies on the sync-failover peers
572922-2 3-Major   Upgrade causes an ASM subsystem error of PL_PARAM_ATTRIBUTES.
568670-2 3-Major   ASM fails to start with error - ndefined subroutine &F5::CRC::get_crc32
559055-1 3-Major   Staging is not disabled on wildcard parameter "*" when Learn New Parameters is set to "Add All"
554324-1 3-Major K32359424 Signatures cannot be updated after Signature Systems have become corrupted in database
539704-2 3-Major   Large ASM REST response causes all REST to hang
531566-2 3-Major   A partial response arrives to the client when response logging is turned on
521370-3 3-Major   Auto-Detect Language policy has disallowed high ASCII meta-characters even after encoding is set to UTF-8
498433-1 3-Major   Upgrading with ASM iRule and virtual server with no websecurity profile
521183-1 4-Minor   Upgrade from 11.2.x (or earlier) to 11.5.x/11.6.x can fail when an active DoS profile exists with 'Prevention Duration' set to a value less than 5


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
579049-1 2-Critical   TMM core due to wrong assert
578353 2-Critical   Statistics data aggregation process is not optimized
575170-3 2-Critical   Analytics reports may not identify virtual servers correctly
598909-1 3-Major   SQL produces errors. AVR does not display any statistics.
596945-2 3-Major   AVR DNS record lost after upgrade.
582029-1 3-Major   AVR might report incorrect statistics when used together with other modules.
569958-2 3-Major   Upgrade for application security anomalies
567355-1 3-Major   Scheduled report lost after loading configuration
559060-3 3-Major   AVR reads BIG-IP system's cookie incorrectly in multiple BIG-IP configuration.
557062-2 3-Major   The BIG-IP ASM configuration fails to load after an upgrade.
525448-1 3-Major   Max TPS is always 0


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
581770-2 1-Blocking   Network Access traffic does not pass IPv6 traffic if a Network Access resource contains IPv4&IPv6
592868-4 2-Critical   Rewrite may crash processing HTML tag with HTML entity in attribute value
591117-1 2-Critical   APM ACL construction may cause TMM to core if TMM is out of memory
580817-3 2-Critical   Edge Client may crash after upgrade
579909-2 2-Critical   Secondary MCPD exits for APM Sandbox warning improperly treated as configuration error
578844-2 2-Critical   tmm cores when switching to IPv6 virtual server while connected to IPv4 virtual server with Edge Client.
575609-3 2-Critical   Zlib accelerated compression can result in a dropped flow.
571090 2-Critical   When BIG-IP is used as SAML IdP, tmm may restart under certain conditions
562919-2 2-Critical   TMM cores in renew lease timer handler
513083-1 2-Critical   d10200: tmm core when using ASM-FPS-AVR-APM-DOS on virtual server.
511478-2 2-Critical   Possible TMM crash when evaluating expression for per-request policy agents.
428068-3 2-Critical   Insufficiently detailed causes for session deletion.
598981-2 3-Major K06913155 APM ACL does not get enforced all the time under certain conditions
597431-4 3-Major   VPN establishment may fail when computer wakes up from sleep
596116-2 3-Major   LDAP Query does not resolve group membership, when required attribute(s) specified
592591-1 3-Major   Deleting access profile prompts for apply access policy for other untouched access profiles
592414-2 3-Major   IE11 and Chrome throw "Access denied" during access to any generic window property after document.write() into its parent has been performed
590820-2 3-Major   Applications that use appendChild() or similar JavaScript functions to build UI might experience slow performance in Microsoft Internet Explorer browser.
589794 3-Major   APD might crash if LDAP Query agent failed to retrieve primary group for a user
589118 3-Major K81314569 Horizon View client throws an exception when connecting to Horizon 7 VCS through APM.
588888-2 3-Major K80124134 Empty URI rewriting is not done as required by browser.
586718-3 3-Major   Session variable substitutions are logged
586006-3 3-Major   Failed to retrieve CRLDP list from client certificate if DirName type is present
585562-1 3-Major   VMware View HTML5 client shipped with Horizon 7 does not work through BIG-IP APM in Chrome/Safari
582526-2 3-Major   Unable to display and edit huge policies (more than 4000 elements)
581834-4 3-Major   Firefox signed plugin for VPN, Endpoint Check, etc
580893-1 3-Major K08731969 Support for Single FQDN usage with Citrix Storefront Integration mode
580421-3 3-Major   Edge Client may not register DLLs correctly
577939-1 3-Major   DNS suffixes on user's machine may not be restored correctly in some cases
576069-2 3-Major   Rewrite can crash in some rare corner cases
575499-1 3-Major   VPN filter may leave renew_lease timer active after teardown
575292-4 3-Major   DNS Relay proxy service does not respond to SCM commands in timely manner
574781-2 3-Major   APM Network Access IPV4/IPV6 virtual may leak memory
573643-2 3-Major   flash.utils.Proxy functionality is not negotiated
573581-4 3-Major   DNS Search suffix are not restored properly in some cases after VPN establishment
573429-1 3-Major   APM Network Access IPv4/IPv6 virtual may leak memory
572887-2 3-Major   DNS doesn't work properly on Ubuntu 15.10 when using f5fpc CLI client
570640-2 3-Major   APM Cannot create symbolic link to sandbox. Error: No such file or directory
570064-3 3-Major   IE gives a security warning asking: "Do you want to run ... InstallerControll.cab"
567660-2 3-Major   Disabling global Auto Last Hop setting breaks APM's Remote Desktop Gateway (RDG) feature
566646-4 3-Major   Portal Access could respond very slowly for large text files when using IE < 11
565231-2 3-Major   Importing a previously exported policy which had two object names may fail
564521-3 3-Major   JavaScript passed to ExternalInterface.call() may be erroneously unescaped
564482-2 3-Major   Kerberos SSO does not support AES256 encryption
563349-4 3-Major   On MAC, Network Access proxy settings are not applied to tun adapter after VPN is established
559218-2 3-Major   Iframes could be inaccessible to a parent window on a page accessed through Portal Access
558946-4 3-Major   TMM may core when APM is provisioned and access profile is attached to the virtual
556597-5 3-Major   CertHelper may crash when performing Machine Cert Inspection
551999-2 3-Major   Edge client needs to re-authenticate after lost network connectivity is restored
551454-5 3-Major   Edge client sends repeated HTTP probe to captive portal probe URL for mis-configured server
551260-2 3-Major   When SAML IdP-Connector Single Sign On Service URL contains ampersand, redirect URL may be truncated
549086-8 3-Major   Windows 10 is not detected when Firefox is used
547546-3 3-Major   Add support for auto-update of MachineCertService
541622-6 3-Major   APD/APMD Crashes While Verifying CAPTCHA
536575-1 3-Major   Session variable report can be blank in many cases
534901-1 3-Major   VMware View HTML5 client may load/initialize with delays
534373-5 3-Major   Some Text on French Localized Edge client on windows has grammatical error
533422-2 3-Major   sessiondump is not reusing connections
528701-2 3-Major   Sessiondump does not accept single dash options
528548-2 3-Major   @import "url" is not recognized by client-side CSS patcher
525429-12 3-Major   DTLS renegotiation sequence number compatibility
519059-3 3-Major   [PA] - Failing to properly patch webapp link, link not working
516219-4 3-Major   User failed to get profile license in VIPRION 4800 chassis if slot 1 is not enabled
508337-4 3-Major   In Chrome, parent.document.write() from frame may cause errors on pages accessed through Portal Access
493106-4 3-Major   HTTP Basic authentication module logs clear text password in /var/log/apm at debug level
479715-3 3-Major   Multi-tab protection problems with multi-domain SSO
409323-3 3-Major   OnDemand cert auth redirect omits port information
584373-3 4-Minor   AD/LDAP resource group mapping table controls are not accessible sometimes
580429-5 4-Minor   CTU does not show second Class ID for InstallerControll.dll
572543-2 4-Minor   User is prompted to install components repeatedly after client components are updated.
554690-3 4-Minor   VPN Server Module generates repeated Error Log "iface eth0 "... every 2 secs
541156-2 4-Minor   Network Access clients experience delays when resolving a host


WebAccelerator Fixes

ID Number Severity Solution Article(s) Description
575631-3 3-Major   Potential MCPd leak in WAM stats query code
562644-4 3-Major   TMM may crash when AAM receives a pipelining HTTP request while shutting down the connection
506557-3 3-Major K45240941 IBR tags might occasionally be all zeroes.
501714-2 3-Major   System does not prevent low quality JPEGs from optimizing to higher quality (becoming larger) does not work when AAM image optimization enabled and JPEG quality in policy is higher than JPEGs on OWS.
476476-7 3-Major   Occasional inability to cache optimized PDFs and images


Service Provider Fixes

ID Number Severity Solution Article(s) Description
578564-3 3-Major   ICAP: Client RST when HTTP::respond in HTTP_RESPONSE_RELEASE after ICAP REQMOD returned HTTP response
573075-2 3-Major   ADAPT recursive loop when handling successive iRule events
572224-4 3-Major   Buffer error due to RADIUS::avp command when vendor IDs do not match
570363-2 3-Major   Potential segfault when MRF messages cross from one TMM to another.
566576-2 3-Major   ICAP/OneConnect reuses connection while previous response is in progress
550434-5 3-Major   Diameter connection may stall if server closes connection before CER/CEA handshake completes
561500-1 4-Minor   ICAP Parsing improvement


Advanced Firewall Manager Fixes

ID Number Severity Solution Article(s) Description
484013-4 2-Critical   tmm might crash under load when logging profile is used with packet classification
575571-2 3-Major   MCPd might leak memory in FW DOS SIP attack stats query.
569337-2 3-Major   TCP events are logged twice in a HA setup


Policy Enforcement Manager Fixes

ID Number Severity Solution Article(s) Description
593070-5 2-Critical   TMM may crash with multiple IP addresses per session
577863-2 3-Major   DHCP relay not forwarding server DHCPOFFER and DHCPACK message after sometime
577814-4 3-Major   MCPd might leak memory in PEM stats queries.
566061-3 3-Major   Subscriber info missing in flow report after subscriber has been deleted


Carrier-Grade NAT Fixes

ID Number Severity Solution Article(s) Description
515736-4 3-Major   LSN pool with small port range may not use all ports


Fraud Protection Services Fixes

ID Number Severity Solution Article(s) Description
561623-3 2-Critical   Realtime encryption causes high CPU usage in older browsers
593667 3-Major   Dashboard displays incomplete alert details when Polish characters are included
583445 3-Major   Alert dashboard does not correctly display Hebrew characters in alerts.
556162-3 3-Major   Default obfuscator configuration causes very slow javascript in some browsers


Traffic Classification Engine Fixes

ID Number Severity Solution Article(s) Description
595270 2-Critical   Memory leaks when session DB tables gets updated
554928-1 2-Critical   tmm eventually crashes when classification profile is configured on the virtual


Device Management Fixes

ID Number Severity Solution Article(s) Description
580686-1 3-Major K70973444 Hostagentd might leak memory on vCMP hosts.



Cumulative fixes from BIG-IP v11.6.1 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
570716-3 CVE-2016-5736 K10133477 BIG-IP IPsec IKE peer listener vulnerability CVE-2016-5736
565169 CVE-2013-5825 CVE-2013-5830 K48802597 Multiple Java Vulnerabilities
542314-5 CVE-2015-8099 K35358312 TCP vulnerability - CVE-2015-8099
572495-3 CVE-2016-5023 K19784568 TMM may crash if it receives a malformed packet CVE-2016-5023
570535 CVE-2011-5321 CVE-2012-6657 CVE-2013-4483 CVE-2014-3184 CVE-2014-3185 CVE-2014-3611 CVE-2014-3940 CVE-2014-6410 CVE-2014-8160 CVE-2014-9420 CVE-2014-9529 CVE-2014-9584 CVE-2015-1593 CVE-2015-1805 CVE-2015-3636 CVE-2015-5307 CVE-2015-5364 CVE-2015-5366 CVE-2015-7613 CVE-2015-7872 CVE-2015-8104 K15685 K15912 K31300371 K16011 K21632201 K31026324 K17239 K17543 K17121 K41739114 K17246 K17458 K17244 K17245 K90230486 K17309 K17307 K31026324 K94105604 Multiple Kernel Vulnerabilities
567475-5 CVE-2015-8704 K53445000 BIND vulnerability CVE-2015-8704
560925-2 CVE-2015-3194 K86772626 OpenSSL Vulnerability fix
560910-2 CVE-2015-3194 K86772626 OpenSSL Vulnerability fix
560180-2 CVE-2015-8000 K34250741 BIND Vulnerability CVE-2015-8000
554624-2 CVE-2015-5300 CVE-2015-7704 K10600056 K17566 NTP CVE-2015-5300 CVE-2015-7704
553902-2 CVE-2015-5300 CVE-2015-7704 CVE-2015-7871 CVE-2015-7855 CVE-2015-7853 CVE-2015-7852 CVE-2015-7850 CVE-2015-7701 CVE-2015-7691 CVE-2015-7692 CVE-2015-7702 CVE-2015-5196 K17516 Multiple NTP Vulnerabilities
546080-5 CVE-2016-5021 K99998454 Path sanitization for iControl REST worker
545786-4 CVE-2015-7393 K75136237 Privilege escalation vulnerability CVE-2015-7393
545762 CVE-2015-7394 K17407 CVE-2015-7394
540767-2 CVE-2015-5621 K17378 SNMP vulnerability CVE-2015-5621
539923-1 CVE-2016-1497 K31925518 BIG-IP APM access logs vulnerability CVE-2016-1497
534090-2 CVE-2015-5380 K17238 Node.js vulnerability CVE-2015-5380
518275-2 CVE-2016-4545 K48042976 The BIG-IP system may stop the normal processing of SSL traffic and dump a TMM core file
508057-1 CVE-2015-0411 K44611310 MySQL Vulnerability CVE-2015-0411
497065-1 CVE-2013-6435 K16383 Linux RPM vulnerability CVE-2013-6435
488015-1 CVE-2014-3669 CVE-2014-3670 CVE-2014-3668 K15866 Multiple PHP vulnerabilities
472093-1 CVE-2015-8022 K12401251 APM TMUI Vulnerability CVE-2015-8022
556383-1 CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 K31372672 Multiple NSS Vulnerabilities
550596-3 CVE-2016-6876 K52638558 RESOLV::lookup iRule command vulnerability CVE-2016-6876
534633-3 CVE-2015-5600 K17113 OpenSSH vulnerability CVE-2015-5600
527762-1 CVE-2015-4000 K16674 TLS vulnerability CVE-2015-4000
525232-1 CVE-2015-4024 CVE-2014-8142 K16826 PHP vulnerability CVE-2015-4024
500089-1 CVE-2015-0206 K16124 OpenSSL vulnerability CVE-2015-0206
472696-1 CVE-2014-1544 K16716 Multiple Mozilla Network Security Services vulnerabilities
470842-1 CVE-2012-5784 K14371 Apache Axis vulnerability CVE-2012-5784
427174-7 CVE-2013-1620 CVE-2013-0791 K15630 SOL15630: TLS in Mozilla NSS vulnerability CVE-2013-1620
560969-2 CVE-2015-3196 K55540723 OpenSSL vulnerability fix
560962-2 CVE-2015-3196 K55540723 OpenSSL Vulnerability CVE-2015-3196
560948-2 CVE-2015-3195 K12824341 OpenSSL vulnerability CVE-2015-3195
527639-2 CVE-2015-1791 K16914 CVE-2015-1791 : OpenSSL Vulnerability
527638-2 CVE-2015-1792 K16915 OpenSSL vulnerability CVE-2015-1792
527637-2 CVE-2015-1790 K16898 PKCS #7 vulnerability CVE-2015-1790
527633-2 CVE-2015-1789 K16913 OpenSSL vulnerability CVE-2015-1789
500094-1 CVE-2014-3570 K16120 OpenSSL vulnerability CVE-2014-3570
500093-1 CVE-2014-8275 K16136 OpenSSL vulnerability CVE-2014-8275
500092-1 CVE-2015-0205 K16135 OpenSSL vulnerability CVE-2015-0205
500090-1 CVE-2014-3572 K16126 OpenSSL vulnerability CVE-2014-3572
494735-1 CVE-2014-3566 K15702 SSLv3 vulnerability CVE-2014-3566
479897-1 CVE-2014-2497 CVE-2014-3538 CVE-2014-3597 CVE-2014-4670 CVE-2014-4698 CVE-2014-5120 CVE-2014-0238 K15761 Multiple PHP 5.x vulnerabilities
567484-5 CVE-2015-8705 K86533083 BIND Vulnerability CVE-2015-8705


Functional Change Fixes

ID Number Severity Solution Article(s) Description
470715-5 2-Critical K16019 Excessive IP fragmentation on tmm_bp vlan causes ftp data loss with vlan name >= 16 characters long
539130-6 3-Major K70695033 bigd may crash due to a heartbeat timeout
530133-3 3-Major   Support for New Platform: BIG-IP 10350 FIPS
520277-2 3-Major   Components validation alert
497395-1 3-Major   Correctly assign severity to check component alerts
493507-1 3-Major   License checks for fictive URLs and injected tags
490537-6 3-Major K15922 Persistence Records display in GUI might cause system crash with large number of records
382157-3 3-Major K17163 Stats presented by the MIB sysVlanStatTable does not match sflow vlan stats


TMOS Fixes

ID Number Severity Solution Article(s) Description
492460-3 1-Blocking K17320 Virtual deletion failure possible when using sFlow
572086 2-Critical K49725838 Unable to boot v11.6.0 on 7250 or 10250 platforms
564427-3 2-Critical   Use of iControl call get_certificate_list_v2() causes a memory leak.
562959-2 2-Critical K37138515 In some error scenarios, IPsec might send packets not intended for the IPsec over the tunnel.
562122-5 2-Critical   Adding a trunk might disable vCMP guest
557680-1 2-Critical   Fast successive MTU changes to IPsec tunnel interface crashes TMM
556380-2 2-Critical   mcpd can assert on active connection deletion
555686-5 2-Critical   Copper SFPs OPT-0015 on 10000-series appliance may cause interfaces to not come up and/or show corrupted serial numbers
554609-4 2-Critical K87381045 Kernel panics during boot when RAM spans multiple NUMA nodes.
552481 2-Critical   Disk provisioning error after restarting ASM service.
551661-2 2-Critical   Monitor with send/receive string containing double-quote may fail to load.
544913-6 2-Critical K17322 tmm core while logging from TMM during failover
544481-5 2-Critical   IPSEC Tunnel fails for more than one minute randomly.
543924 2-Critical   Update kernel to latest public RHEL6.4 kernel: 2.6.32-358.61.1.el6
520380-6 2-Critical K41313442 save-on-auto-sync can spawn multiple invocations of tmsh, starving system of memory
511527-2 2-Critical   snmpd segmentation fault at get_bigip_profile_user_stat()
510559-6 2-Critical   Add logging to indicate that compression engine is stalled.
505071-5 2-Critical   Delete and create of the same object can cause secondary blades' mcpd processes to restart.
504508-5 2-Critical K16773 IPsec tunnel connection from BIG-IP to some Cisco ASA does not stay up when DPD (Dead Peer Detection) is enabled
503600-6 2-Critical K17149 TMM core logging from TMM while attempting to connect to remote logging server
502841-2 2-Critical K17580 REST API hangs due to icrd startup issues
490801-2 2-Critical   mod_ssl: missing support for TLSv1.1 and TLSv1.2
484453-6 2-Critical K15853 Messages logged when registering with LOP daemon (lopd) or CAN daemon (cand)
365219-2 2-Critical   Trust upgrade fails when upgrading from version 10.x to version 11.x.
606540-1 3-Major K33064211 DB variable changed via GUI does not sync across HA group
567774-1 3-Major   ca-devices and non-ca-devices addition/deletion has been removed from restart cm trust-domain Root
563475-3 3-Major K00301400 ePVA dynamic offloading can result in immediate eviction and re-offloading of flows.
562928 3-Major   Curl connections with 'local-port' option fail sometimes over IPsec tunnels when connection.vlankeyed db variable is disabled
560423-2 3-Major   VxLAN tunnel IP address modification is not supported
560220-1 3-Major   Missing partition and subPath fields for some objects in iControl REST
559584-2 3-Major K23410869 tmsh list/save configuration takes a long time when config contains nested objects.
558573-2 3-Major K65352421 MCPD restart on secondary blade after updating Pool via GUI
556284-5 3-Major K55622762 iqsyncer: GTM/LC config sync failure with error from local mcpd Monitor parent not found
555905-3 3-Major   sod health logging inconsistent when device removed from failover group or device trust
554563-3 3-Major   Error: Egress CoS queue packet drop counted against both Drops In and Drops Out statistics.
554340-4 3-Major   IPsec tunnels fail when connection.vlankeyed db variable is disabled
553649-3 3-Major   The SNMP daemon might lock up and fail to respond to SNMP requests.
553576-3 3-Major K17356 Intermittent 'zero millivolt' reading from FND-850 PSU
552585-3 3-Major K32030059 AAA pool member creation sets the port to 0.
551927-2 3-Major   ePVA snoop header's transform vlan should be set properly under asymmetric routing condition
551742-2 3-Major   Hardware parity error mitigation for the SOURCE_VP table on 10000s/10200v/10250v platforms and B4300/B4340N and B2250 blades
550694-3 3-Major K60222549 LCD display stops updating and Status LED turns/blinks Amber
550536-3 3-Major   Incorrect information/text (in French) is displayed when the Edge Client is launched
549543-3 3-Major K37436054 DSR rejects return traffic for monitoring the server
548239-3 3-Major K04844213 BGP routing using route-maps cannot match route tags
547532-2 3-Major   Monitor instances in a partition that uses a non-default route domain can fail validation on secondary blades
541569-3 3-Major K59519340 IPsec NAT-T (IKEv1) not working properly
540996-2 3-Major   Monitors with a send attribute set to 'none' are lost on save
540871-1 3-Major K01418954 Update/deletion of SNMPv3 user does not work correctly
539822-4 3-Major   tmm may leak connflow and memory on vCMP guest.
539784-4 3-Major   HA daemon_heartbeat mcpd fails on load sys config
538663-3 3-Major   SSO token login does not work due to remote role update failures.
538024-3 3-Major K60507424 Configuration containing a virtual server with a named wildcard destination address ('any6') may fail to load
534582-4 3-Major K10397582 HA configuration may fail over when standby has only base configuration loaded.
534076-2 3-Major K34873265 SNMP configured trap-source might not be used in v1 snmp traps.
533826-5 3-Major   SNMP Memory Leak on a VIPRION system.
531986-3 3-Major   Hourly AWS VE license breaks after reboot with default tmm route/gateway.
531705-2 3-Major K53725847 List commands on non-existent iRules incorrectly succeeds.
530242-3 3-Major K08654415 SPDAG on VIPRION B2250 blades might cause traffic imbalance among TMMs
529977-1 3-Major   OSPF may not process updates to redistributed routes
529484-4 3-Major   Virtual Edition Kernel Panic under load
528987-3 3-Major   Benign warning during formatting installation
528276-7 3-Major K39167163 The device management daemon can crash with a malloc error
526817-4 3-Major   snmpd core due to mcpd message timer thread not exiting
526031-2 3-Major K38429933 OSPFv3 may not completely recover from "clear ipv6 ospf process"
524300-2 3-Major K71003856 The MOS boot process appears to hang.
523867-3 3-Major   'warning: Failed to find EUDs' message during formatting installation
522871-1 3-Major K13764703 [TMSH] nested wildcard deletion will delete all the objects (matched or not matched)
522837-1 3-Major   MCPD can core as a result of another component shutting down prematurely
522332-1 3-Major K81374736 Configuration upgrade of httpclass which has the 'hosts' attribute done incorrectly
521144-5 3-Major K16799 Network failover packets on the management interface sometimes have an incorrect source-IP
517388-7 3-Major   Parsing the DN (for subject or issuer) in a certificate does not take into account all the possible RDNs.
517209-7 3-Major K81807474 tmsh save sys config file /var/tmp or /shared/tmp can make some BIG-IP functionality unusable
517020-5 3-Major   SNMP requests fail and subsnmpd reports that it has been terminated.
516322-7 3-Major   The BIG-IP system may erroneously remove an iApp association from the virtual server.
513974-7 3-Major K16691 Transaction validation errors on object references
513659-3 3-Major K72841425 AAM Policy not all regex characters can be used via the GUI
512130-4 3-Major   Remote role group authentication fails with a space in LDAP attribute group name
510381-3 3-Major   bcm56xxd might core when restarting due to bundling config change.
503246-4 3-Major   TMM crashes when unable to allocate large amount of provisioned memory
496679-5 3-Major   Configuration loads may fail because the 'default-device' on a traffic-group object does not contain a valid value.
495865-2 3-Major K15116582 iApps/tmsh cannot reconfigure pools that have monitors associated with them.
491727-2 3-Major K17029 Upgrade can fail to load config due to tcp profile no longer allowing time-wait-timeout of 4294967295 (indefinite).
482373-3 3-Major   Can not delete and re-create a new virtual server that uses the same virtual address in the same transaction
480246-4 3-Major K17080 Message: Data publisher not found or not implemented when processing request
473415-1 3-Major K93511901 ASM Standalone license has to include URL and HTML Rewrite
449453-5 3-Major K17368 Loading the default configuration may cause the mcpd process to restart and produce a core file.
439559-2 3-Major K16262 APM policy sync resulting in failover device group sync may make the failover sync fail
433466-4 3-Major   Disabling bundled interfaces affects first member of associated unbundled interfaces
421012-3 3-Major K73028377 scriptd incorrectly reports that it is running on a secondary blade
405635-2 3-Major   Using the restart cm trust-domain command to recreate certificates required by device trust.
553174-4 4-Minor   Unable to query admin IP via SNMP on VCMP guest
533790-4 4-Minor   Creating multiple address entries in data-group might result in records being incorrectly deleted
519216-4 4-Minor   Abnormally high CPU utilization from external SSL/OpenSSL monitors
480071-2 4-Minor K75451516 Backslashes in policy rule added/duplicated when modified in GUI.
401893-3 4-Minor   Allowing tilde in HTTP Profile fields Response Headers Allowed and Encrypt Cookies
223884 4-Minor   Module not licensed message appears when APM is provisioned and APML is licensed.
572133-2 5-Cosmetic   tmsh save /sys ucs command sends status messages to stderr
413708-5 5-Cosmetic K31302478 BIG-IP system may use an ephemeral source port when sending SNMP IPv6 UDP response.
388274-3 5-Cosmetic   LTM pool member link in a route domain is wrong in Network Map.
291469-2 5-Cosmetic K10643 SNMP query fails to return ARP entries when the ARP table exceeds 2,048 entries.


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
536690-4 1-Blocking K82591051 Occasional host-tmm connections within a chassis will fail (affects APM processes trying to connect to a tmm)
476386-2 1-Blocking   DHE-RSA-AES256-SHA256 and DHE-RSA-AES128-SHA256 should only be supported for tls1.2
576314-2 2-Critical   SNMP traps for FIPS device fault inconsistent among versions.
565810-2 2-Critical K93065637 OneConnect profile with an idle or strict limit-type might lead to tmm core.
562566-2 2-Critical K39483533 High Availability connection flap may cause mirrored persistence entries to be retained after expiration on multi-blade systems
554967-3 2-Critical   Small Client EDNS0 Limits can Sometimes Truncate DNSSEC or iRule DNS Packets
552151-2 2-Critical   Continuous error report in /dev/log/ltm: Device error: n3-compress0 Nitrox 3, Hang Detected
549782-1 2-Critical   XFV driver can leak memory
545810-1 2-Critical   ASSERT in CSP in packet_reuse
544375-1 2-Critical   Unable to load certificate/key pair
542564-3 2-Critical   bigd detection and logging of load and overload
540568-2 2-Critical   TMM core due to SIGSEGV
540473-6 2-Critical   peer/clientside/serverside script with parking command may cause tmm to core.
537988-5 2-Critical K76135297 Buffer overflow for large session messages
534804-2 2-Critical   TMM may core with rate limiting enabled and service-down-action reselect on poolmembers
534052-3 2-Critical K17150 VLAN failsafe triggering on standby leaks memory
530505-4 2-Critical   IP fragments can cause TMM to crash when packet filtering is enabled
529920-7 2-Critical   Connection mirroring with OneConnect on a virtual server can cause TMM crash on standby unit
528739-1 2-Critical K47320953 DNS Cache might use cached data from ADDITIONAL sections in ANSWER responses.
527011-6 2-Critical   Intermittent lost connections with no errors on external interfaces
525882-2 2-Critical K29113720 SSL client certificate verification during SSL handshake might leak a reference to the issuer certificate.
524605-2 2-Critical K55311422 Requests/responses may not be fully delivered to plugin in some circumstances
523995-2 2-Critical   IPv4 link-local addresses can cause TMM crash when used in conjunction with ECMP routes
521336-6 2-Critical   pkcs11d initialization retry might post misleading error messages and eventually result in a pkcs11d core
520105-3 2-Critical   Possible segfault during hardware accelerated compression.
517465-4 2-Critical   tmm crash with ssl
509284-2 2-Critical   Improved reliability of a module interfacing with HSM
507611-4 2-Critical K17151 On BIG-IP 2000- and 4000-series platforms BGP sessions with TCP MD5 enabled might fail to establish connection to neighbors.
489451-3 2-Critical K17278 TMM might panic due to OpenSSL failure during handshake generation
489329-6 2-Critical   Memory corruption can occur with SPDY/HTTP2 profile(s)
484214-2 2-Critical   Nitrox got stuck when processed certain SSL records
483719-2 2-Critical K16260 vlan-groups configured with a single member VLAN result in memory leak
341928-4 2-Critical K16482 CMP enabled virtual servers which target CMP disabled virtual servers can crash TMM.
570617-4 3-Major   HTTP parses fragmented response versions incorrectly
564371-2 3-Major   FQDN node availability not reset after removing monitoring
562308-2 3-Major   FQDN pool members do not support manual-resume
562292-1 3-Major   Nesting periodic after with parking command could crash tmm
560685 3-Major   TMM may crash with 'tmsh show sys conn'.
559933-2 3-Major K83032815 tmm might leak memory on vCMP guest in SSL forward proxy
558517-3 3-Major   Upgrading results in additional escaping for monitor send/recv strings in /config/bigip.conf.
557783-2 3-Major K14147369 TMM generated traffic to external IPv6 global-addr via ECMP routes might use link-local addr
556568-2 3-Major   TMM can crash with ssl persistence and fragmented ssl records
556560-2 3-Major K80741043 DNS messages may become malformed if the Additional section contains an OPT record followed by multiple records.
556103-3 3-Major   Abnormally high CPU utilization for external monitors
554769-4 3-Major   CPM might crash when TCLRULE_HTTP_RESPONSE is triggered.
554761-5 3-Major   Unexpected handling of TCP timestamps under syncookie protection.
553688-4 3-Major   TMM can core due to memory corruption when using SPDY profile.
553613-3 3-Major   FQDN nodes do not support session user-disable
552931-4 3-Major   Configuration fails to load if DNS Express Zone name contains an underscore
552865-4 3-Major K34035224 SSL client authentication should ignore invalid signed Certificate Verify message when PCM is set to 'request'.
550782-4 3-Major   Cache Lookups for Validating Resolvers ignore the query's DNSSEC OK (DO) bit
550689-2 3-Major   Resolver H.ROOT-SERVERS.NET Address Change
549800-2 3-Major K53086012 Renaming a virtual server with an attached plugin can cause buffer overflow
549406-5 3-Major K63010180 Destination route-domain specified in the SOCKS profile
548680-2 3-Major   TMM may core when reconfiguring iApps that make use of iRules with procedures.
548678-2 3-Major   ASM blocking page does not display when using SPDY profile
548563-2 3-Major   Transparent Cache Messages Only Updated with DO-bit True
547732-1 3-Major   TMM may core on using SSL::disable on an already established serverside connection
544028-5 3-Major K21131221 Verified Accept counter 'verified_accept_connections' might underflow.
543220-1 3-Major K12153351 Global traffic statistics does not include PVA statistics
542724-1 3-Major K29441414 If there is OCSP Stapling enabled on a clientSSL profile, under certain remote conditions, TMM could crash
542640-2 3-Major   bigd intentionally cores when it should shutdown cleanly
541571-3 3-Major K97140208 FQDN ephemeral nodes not repopulated after recreating with swapped IP addresses
538639-3 3-Major   P-256 ECDH performance improvements
538603-2 3-Major K03383492 TMM core file on pool member down with rate limit configured
537964-4 3-Major K17388 Monitor instances may not get deleted during configuration merge load
535759-3 3-Major K99840695 SMTP monitor might mark the server down even if the server answers the HELO message.
534457-2 3-Major   Dynamically discovered routes might fail to remirror connections.
533820-5 3-Major   DNS Cache response missing additional section
532911-2 3-Major K03753124 Setting 'Untrusted Certificate Response Control' to ignore in server SSL profile does not ignore self-signed untrusted certificates.
532107-2 3-Major K16716213 [LTM] [DNS] Maximum RTT value for nameserver cache still exists after nameserver cache is deleted
530761-1 3-Major   TMM crash in DNS processing on a TCP virtual
529899-1 3-Major   Installation may fail with the error "(Storage modification process conflict.)".
528407-4 3-Major K72235143 TMM may core with invalid lasthop pool configuration
528007-6 3-Major   Memory leak in ssl
527149-3 3-Major K57034242 FQDN template node transitions to 'unknown' after configuration reload
527027-4 3-Major   DNSSEC Unsigned Delegations Respond with Parent Zone Information
527024-3 3-Major   DNSSEC Unsigned Delegations Respond with Parent Zone Information
525989-2 3-Major K17165 A disabled blade is spontaneously re-enabled
525958-11 3-Major   TMM may crash if loadbalancing to node's IP in iRule routed towards an unreachable nexthop.
525672-2 3-Major   tmm memory leak with SSL forward proxy virtual server having CLIENTSSL_CLIENTHELLO with SNI lookup.
525322-7 3-Major   Executing tmsh clientssl-proxy cached-certs crashes tmm
524960-2 3-Major K17434 'forward' command does not work if virtual server has attached pool
524641-1 3-Major K11504283 Wildcard NAPTR record after deleting the NAPTR records
523471-2 3-Major   pkcs11d core when connecting to SafeNet HSM
519217-4 3-Major K89004553 tmm crash: valid proxy
517282-7 3-Major K63316585 The DNS monitor may delay marking an object down or never mark it down
517053-2 3-Major   bigd detection and logging of load and overload
516816-4 3-Major   RSA key with DSA-signed or ECDSA-signed certificate silently fails handshake.
515759-3 3-Major K92401129 Configuration objects with more than four vlans in vlan list may cause memory utilization to increase over time
513213-5 3-Major   FastL4 connection may get RSTs in case of hardware syncookie enabled.
513142-3 3-Major   FQDN nodes with a default monitor may cause configuration load failure
512119-2 3-Major   Improved UDP DNS packet truncation
511057-5 3-Major K60014038 Config sync fails after changing monitor in iApp
510264-1 3-Major   TMM core associated with smtps profile.
509641-3 3-Major K46511710 Ephemeral pool members may not inherit attributes from FQDN parent
507410-2 3-Major   Possible TMM crash when handling certain types of traffic with SSL persistence enabled
507109-4 3-Major   inherit-certkeychain attribute of child Client SSL profile can unexpectedly change during upgrade
505089-4 3-Major   Spurious ACKs result in SYN cookie rejected stat increment.
504545-2 3-Major K17419 FQDN: node without service checking reported as 'service checking enabled, no results yet'
502480-1 3-Major   Mirrored connections on standby device do not get closed when Verified Accept is enabled
500786-6 3-Major   Heavy memory usage while using fastL4/BIGTCP virtual with HTTP profile
499430-2 3-Major K16623 Standby unit might bridge network ingress packets when bridge_in_standby is disabled
488921-2 3-Major   BIG-IP system sends unnecessary gratuitous ARPs
476567-5 3-Major K16561 fastL4: acceleration state is incorrectly reported on show sys conn
476564-5 3-Major K16884 ePVA FIX: no RST for an unaccelerated flow targeting a network virtual
475701-2 3-Major   FastL4 with FIX late-bind enabled may not honor client-timeout
472532-4 3-Major   Cipher dhe-rsa-aes256-sha256 is missing from the SSL cipher list
460946-2 3-Major   NetHSM key is displayed as normal in GUI
458348-2 3-Major   RESOLV:: iRule commands and sFlow don't function correctly when using non-default CMP hashing.
455762-1 3-Major K17094 DNS cache statistics incorrect
452443-2 3-Major   DNS cache resolver cannot send egress traffic on a VLAN with src-ip or dst-ip cmp hash configured
452439-5 3-Major K15574 TMM may crash when enabling DOS sweep/flood if a TMM process has multiple threads
446526-7 3-Major   TCP virtual server/UDP virtual server without datagram-LB mode enabled running DNS cache and suspending iRules might cause TMM crash.
441058 3-Major K17366 TMM can crash when a large number of SSL objects are created
424831-6 3-Major K14573 State Mirroring does not work for an HA pair that uses only hardwired (serial) failover, without network failover
418890-2 3-Major K92193116 OpenSSL bug can prevent RSA keys from rolling forward
406001-3 3-Major   Host-originated traffic cannot use a nexthop in a different route domain
372473-2 3-Major   mcp error 0x1020003 may be logged to /var/log/tmm when TMM crashes
554774-2 4-Minor K85545015 Persist lookup across services might fail to return a matching record when multiple records exist.
551614-2 4-Minor K10607444 MTU Updates should erase all congestion metrics entries
546747-2 4-Minor K72042050 SSL connections may fail with a handshake failure when the ClientHello is sent in multiple packets
541134-2 4-Minor K51114681 HTTP/HTTPS monitors transmit unexpected data to monitored node.
534458-6 4-Minor K17196 SIP monitor marks down member if response has different whitespace in header fields.
452482-7 4-Minor K16014 HTTP virtual servers with cookie persistence might reset incoming connections
558053-2 5-Cosmetic   Pool's 'active_member_cnt' attribute may not be updated as expected.
529897-1 5-Cosmetic   Diameter monitor logging displays hex when monitor failing instead of the AVP which the monitor is failing on.


Performance Fixes

ID Number Severity Solution Article(s) Description
489816-1 1-Blocking   F5 Enterprise MIB attribute sysTmmStatMemoryTotal returning zero
548796-2 2-Critical   Avrd is at CPU is 100%


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
533658-5 2-Critical   DNS decision logging can trigger TMM crash
471467 2-Critical   gtmparse segfaults when loading wideip.conf because of duplicate virtual server names
469033 2-Critical   Large big3d memory footprint.
551767-3 3-Major K03432500 GTM server 'Virtual Server Score' not showing correctly in TMSH stats
546640 3-Major   tmsh show gtm persist <filter option> does not filter correctly
529460-7 3-Major K17209 Short HTTP monitor responses can incorrectly mark virtual servers down.
526699-6 3-Major K40555016 TMM might crash if BIG-IP DNS iRule nodes_up references invalid IP/Port.
481328-2 3-Major K50139533 Many 'tmsh save sys config gtm-only partitions all' stack memory issue.
552352-2 4-Minor K18701002 tmsh list display incorrectly for default values of gtm listener translate-address/translate-port
494796 4-Minor   Unable to create GTM Listener with non-default protocol profile.


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
565463-2 1-Blocking   ASM-config consumes 1.3GB RAM after repeated Policy Import via REST
566758-2 2-Critical   Manual changes to policy imported as XML may introduce corruption for Login Pages
555057-3 2-Critical   ASM REST: Removing a Signature Set From One Security Policy Removes It From All Security Policies.
555006-3 2-Critical   ASM REST: lastUpdateMicros is not updated when changing a Custom Signature
552139-2 2-Critical K61834804 ASM limitation in the pattern matching matrix builtup
478351-1 2-Critical K17319 Changing management IP can lead to bd crash
475551-1 2-Critical   Flaw in CSRF protection mechanism
474252-1 2-Critical K17344 Applying ASM security policy repeatedly fills disk partition on a chassis
574451-2 3-Major K90243258 ASM chassis sync occasionally fails to load on secondary slot
563237 3-Major   ASM REST: name for ipIntelligenceReference is incorrect
562775-2 3-Major   Memory leak in iprepd
558642-1 3-Major   Cannot create the same navigation parameter in two different policies
554367-1 3-Major   BIG-IQ ASM remote logger: Requests are not be logged.
553146-2 3-Major K95632194 BD memory leak
547000-4 3-Major K47219203 Enforcer application might crash on XML traffic when out of memory
542511-2 3-Major K97242554 'Unhandled keyword ()' error message in GUI and/or various ASM logs
541852-1 3-Major   ASM REST: PATCH to XML Profiles with unmodified "validationFiles" fails
541406-1 3-Major   ASM REST: XML Profile Validation File Associations are Removed on a Partial PATCH Request
540390-2 3-Major   ASM REST: Attack Signature Update cannot roll back to older attack signatures
538195-1 3-Major   Incremental Manual sync does not allow overwrite of 'newer' ASM config
535188-3 3-Major   Response Pages custom content with \n instead of \r\n on policy import.
534246-2 3-Major   rest_uuid should be calculated from the actual values inserted to the entity
531809-2 3-Major   FTP/SMTP traffic related bd crash
530598-1 3-Major   Some Session Tracking data points are lost on TMM restart
529610-1 3-Major K32565535 On HA setups ASM session tracking page display an empty list when in fact there are asm entries in session db
529535-4 3-Major   MCP validation error while deactivating a policy that is assigned to a virtual server
526162-7 3-Major K52335623 TMM crashes with SIGABRT
520732-3 3-Major   XML policy import adds default entities if the relevant element list (in policy xml doc) is specified and empty
514313-1 3-Major K00884154 Logging profile configuration is updated unnecessarily
514061-4 3-Major K17562 False positive scenario causes SMTP transactions to hang and eventually reset.
503696-1 3-Major   BD enforcer updates may be stuck after BD restart
491371-1 3-Major K17285 CMI: Manual sync does not allow overwrite of 'newer' ASM config
491352-3 3-Major   Added ASM internal parameter to add more XML memory
481530-1 3-Major K86019555 Signature reporting details for sensitive data violation
538837-1 4-Minor   REST: Filtering login pages or parameters by their associated URL does not work


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
529900-1 2-Critical K88373692 AVR missing some configuration changes in multiblade system
519257-2 2-Critical   cspm script isn't injected in text/html chuncked response
470559 2-Critical   TMM crash after traffic stress with rapid changes to Traffic capturing profiles
552488-1 3-Major K73600514 Missing upgrade support for AFM Network DoS reports.
549393-3 3-Major K73435148 SWG URL categorization may cause the /var/lib/mysql file system to fill.
535246-6 3-Major K17493 Table values are not correctly cleaned and can occupy entire disk space.
530952-1 3-Major   MySql query fails with error number 1615 'Prepared statement needs to be re-prepared'
529903-1 3-Major   Incorrect reports on multi-bladed systems
528031-3 3-Major K10097225 AVR not reporting the activity of standby systems.
491185-1 3-Major   URL Latencies page: pagination limited to 180 pages
490999-2 3-Major   Subscriber-level AVR statistics display the subscriber-type as "Unknown" for subscribers created using Radius Acct-Start
537435-1 4-Minor   Monpd might core if asking for export report by email while monpd is terminating
495744-1 4-Minor   Some user defined ASM reports are not loading correctly after upgrade from 11.4 upwards


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
553330-3 1-Blocking   Unable to create a new document with SharePoint 2010
579559-2 2-Critical   DTLS Networks Access may not work with some hardware platforms with Nitrox hardware acceleration
572563-3 2-Critical   PWS session does not launch on Internet Explorer
569306-3 2-Critical   Edge client does not use logon credentials even when "Reuse Windows Logon Credentials" is selected
565056-3 2-Critical K87617654 Fail to update VPN correctly for non-admin user.
555507-2 2-Critical K88973987 Under certain conditions, SSO plugin can overrun memory not owned by the plugin.
555272-8 2-Critical   Endpoint Security client components (OPSWAT, EPSEC) may fail to upgrade
551764-3 2-Critical K14954742 [APM] HTTP status 500 response of successful Access Policy in clientless mode on chassis platform
530622-1 2-Critical   EAM plugin uses high memory when serving very high concurrent user load
522997-3 2-Critical K52553016 Websso cores when it tries to shutdown
491080-5 2-Critical K92821195 Memory leak in access framework
571003-1 3-Major   TMM Restarts After Failover
570563-2 3-Major K35470551 CRL is not being imported/exported properly
569255-3 3-Major K81130213 Network Access incorrectly manipulates routing table when second adapter being connected if "Allow Local subnet access' is set to ON
566908-5 3-Major K54435973 Webserver listening on local Wifi or ethernet IP cannot be accessed after VPN with proxy.pac file
565527-3 3-Major K94548429 Static proxy settings are not applied if NA configuration
564496-3 3-Major   Applying APM Add-on License Does Not Change Effective License Limit
564493 3-Major K74284318 Copying an access profile appends an _1 to the name.
564262-4 3-Major K21518043 Network Access does not work if DNS cannot be resolved on client and PAC file contains DNS resolution code
564253-5 3-Major   Firefox signed plugin for VPN, Endpoint Check, etc
563474-2 3-Major K51244380 SNMP F5-BIGIP-APM-MIB::apmPmStatConfigSyncState returns 0 for edited access profile
561976 3-Major K55561335 Values of high-water and low-water mark for 'apd' pending request queue might not handle requests completely.
558870-3 3-Major K12012384 Protected workspace does not work correctly with third party products
558631-2 3-Major K81306414 APM Network Access VPN feature may leak memory
555457-5 3-Major K16415235 Reboot is required, but not prompted after F5 Networks components have been uninstalled
555435-2 3-Major K34742242 AD Query fails if cross-domain option is enabled and administrator's credentials are not specified
554993-2 3-Major   Profile Stats Not Updated After Standby Upgrade Followed By Failover
554899-2 3-Major K57540380 MCPD core with access policy macro during config sync in HA configuration
554626-1 3-Major K14263316 Database logging truncates log values greater than 1024
554228-5 3-Major   OneConnect does not work when WEBSSO is enabled/configured.
554041-5 3-Major   No connectivity inside enterprise network for "Always Connected" client if Network Location Awareness is enabled
553734-1 3-Major   Issue with assignment of non-string value to Form.action in javascript.
553063-1 3-Major   Epsec version rolls back to previous version on a reboot
552498-1 3-Major   APMD basic authentication cookie domains are not processed correctly
549588-2 3-Major   EAM memory leak when cookiemap is destroyed without deleting Cookie object in it
549108-1 3-Major K52519223 RDP resource 'Custom parameters' fail to accept parameters containing spaces or colon in the value
548361 3-Major   Performance degradation when adding VDI profile to virtual server
543222-3 3-Major   apd may crash if an un-encoded session variable contains "0x"
539270-6 3-Major   A specific NTLM client fails to authenticate with BIG-IP
539229-7 3-Major   EAM core while using Oracle Access Manager
531983-5 3-Major   [MAC][NA] Routing table is not updated correctly in connected state when new adapter is added
528808-3 3-Major   Source NAT translation doesn't work when APM is disabled using iRule
526637-4 3-Major   tmm crash with APM clientless mode
522791-2 3-Major K45123459 HTML rewriting on client might leave 'style' attribute unrewritten.
520088-2 3-Major   Citrix HTML5 Receiver does not properly display initial tour and icons
518550-3 3-Major   Incorrect value of form action attribute inside 'onsubmit' event handler in some cases
517846-2 3-Major K25627866 View Client cannot change AD password in Cross Domain mode
511893-5 3-Major   Client connection timeout after clicking Log In to Access Policy Manager on a Chassis
492122-5 3-Major K42635442 Now Windows Logon Integration does not recreate temporary user for logon execution each time
488811-5 3-Major   F5-prelogon user profile folder are not fully cleaned-up
482177-4 3-Major K16777 Accessing Sharepoint web application portal interferes with IdP initiated SAML SSO
472446-2 3-Major   Customization group template file might cause mcpd to restart
471318-1 3-Major K22671941 AD/LDAP group name matching should be case-insensitive
467256-2 3-Major K25633150 Deleting OPSWAT/Epsec packages from GUI does not delete files from disk causing UCS packages to bloat
462598-4 3-Major K17184 Failover triggered due to a TMM crash resulting from unavailable APM renderer pool members.
462258-8 3-Major   AD/LDAP server connection failures might cause apd to stop processing requests when service is restored
461084-3 3-Major K48281763 Kerberos Auth might fail if client request contains Authorization header
389328-7 3-Major   RSA SecurID node secret is not synced to the standby node


WebAccelerator Fixes

ID Number Severity Solution Article(s) Description
551010-7 3-Major   Crash on unexpected WAM storage queue state
525478-2 3-Major K80413728 Requests for deflate encoding of gzip documents may crash TMM


Wan Optimization Manager Fixes

ID Number Severity Solution Article(s) Description
552198-5 3-Major   APM App Tunnel/AM iSession Connection Memory Leak
547537-3 3-Major   TMM core due to iSession tunnel assertion failure


Service Provider Fixes

ID Number Severity Solution Article(s) Description
538784-3 3-Major K91532102 ICAP implementation incorrect when HTTP request or response is missing a payload
523854-1 3-Major K35305250 TCP reset with RTSP Too Big error when streaming interleaved data
545985-3 4-Minor   ICAP 2xx response (except 200, 204) is treated as error


Advanced Firewall Manager Fixes

ID Number Severity Solution Article(s) Description
561433-3 3-Major   TMM Packets can be dropped indiscriminately while under DOS attack
489379-1 3-Major   Bot signature is not matched


Policy Enforcement Manager Fixes

ID Number Severity Solution Article(s) Description
529634-2 2-Critical   Crash observed with HSL logging
512069-2 2-Critical   TMM restart while relicensing the BIG-IP using the base license.
510923-2 2-Critical   TMM crashes on the disabled secondary blade and bigstart restart or reboot is triggered.
565765-3 3-Major   Flow reporting does not occur for unclassified flows.
564263-3 3-Major   PEM: TMM asserts when Using Debug Image when Gy is being used
560607-3 3-Major   Resource Limitation error when removing predefined policy which has multiple rules
559382-1 3-Major   Subscriber ID type should be set to NAI over Diameter for DHCP discovered subscribers
557675-3 3-Major   Failover from PEM to PCRF can cause session lookup inconsistency
549283-3 3-Major   Add a log message to indicate transition in the state of Gx and Gy sessions.


Carrier-Grade NAT Fixes

ID Number Severity Solution Article(s) Description
555369-3 2-Critical K43151094 CGNAT memory leak when non-TCP/UDP traffic directed at public addresses
545783-3 2-Critical   TMM crashes when forwarding an inbound connection on Large Scale NAT (LSN) pool
540571-2 2-Critical   TMM cores when multicast address is set as destination IP via iRules and LSN is configured
540484-2 2-Critical K04005785 "show sys pptp-call-info" command can cause tmm crash
535101-1 2-Critical   Connections to LSN pools in PBA mode may cause tmm core if used in conjunction with udp_gtm_dns profile.


Fraud Protection Services Fixes

ID Number Severity Solution Article(s) Description
564039-3 2-Critical   WebSafe "Missing component" check gets applied on request with different referrer domain.
563554-3 2-Critical   Accept-language in alerts
559129-3 2-Critical   Update Generic Malware Signatures to detect new Dyre variant
554540 2-Critical   RAT detection failure
554537-2 2-Critical   Failed alerts on Internet Explorer
541670-1 2-Critical   Memory leak and potential crash bug in secure channel cookie handling
537106-3 2-Critical   Component checks wait for page load
564040-4 3-Major   Differentiation of missing component alerts
560069-1 3-Major   Default obfuscator configuration causes very slow javascript in some browsers
558255-2 3-Major   Filtering encryption alerts
555818-3 3-Major   Bait failure alerts do not give details of the cause of failure
554546-2 3-Major   Only first entry in 'Mandatory Words' list is effective
552476-2 3-Major   Use of JavaScript's 'eval' function may be prohibited by site's content security policy
551893-2 3-Major   Alerts send from FPS plugin via HSL are sent in a malformed HTTP format
542586-3 3-Major   Fallback alert mechanism can result in page refresh in Internet Explorer 8
542581-3 3-Major   WebSafe alerts with HTML attached cause the page to run slowly
542472 3-Major   SSL::disable for alerts does not take effect and first alert fails
503160-3 3-Major   FPS malicious words doesn't trigger alert when ignore list is defined
560791 4-Minor   FPS doesn't encrypt inputs of type "hidden"
555827-2 4-Minor   No fallback for alerts.
547038-2 4-Minor   In very fast transactions, some detection data is missing


Device Management Fixes

ID Number Severity Solution Article(s) Description
538722-3 3-Major K06150134 Configurable maximum message size limit for restjavad


iApp Technology Fixes

ID Number Severity Solution Article(s) Description
546082-5 2-Critical   Special characters might change input.



Cumulative fixes from BIG-IP v11.6.0 Hotfix 8 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
600662-4 CVE-2016-5745 K64743453 NAT64 vulnerability CVE-2016-5745
599168-4 CVE-2016-5700 K35520031 BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700
598983-4 CVE-2016-5700 K35520031 BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700
580596-9 CVE-2013-0169 CVE-2016-6907 K14190 K39508724 TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 / TMM SSL/TLS virtual server vulnerability CVE-2016-6907
569467-11 CVE-2016-2084 K11772107 BIG-IP and BIG-IQ cloud image vulnerability CVE-2016-2084.


Functional Change Fixes

ID Number Severity Solution Article(s) Description
557221-7 2-Critical   Inbound ISP link load balancing will use pool members for only one ISP link per data center


TMOS Fixes

ID Number Severity Solution Article(s) Description
596603-11 2-Critical   AWS: BIG-IP VE doesn't work with c4.8xlarge instance type.
547047 2-Critical K31076445 Older cli-tools unsupported by AWS
595874-4 3-Major   Upgrading 11.5.x/11.6.x hourly billing instances to 12.1.0 fails due to license SCD.
556277-6 3-Major   Config Sync error after hotfix installation (chroot failed rsync error)
499537-3 3-Major K22406859 Qkview may store information in the wrong format


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
557645-5 3-Major   Communication between devices in a high availability (HA) configuration might occasionally fail on VIPRION 2200 and 2400 platforms.



Cumulative fixes from BIG-IP v11.6.0 Hotfix 7 that are included in this release


Functional Change Fixes

None


TMOS Fixes

ID Number Severity Solution Article(s) Description
591857 1-Blocking   10-core vCMP guest with ASM may not pass traffic



Cumulative fixes from BIG-IP v11.6.0 Hotfix 6 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
532522-3 CVE-2015-1793 K16937 CVE-2015-1793
536984 CVE-2015-8240 K06223540 Ensure min_path_mtu is functioning as designed.
536481-9 CVE-2015-8240 K06223540 F5 TCP vulnerability CVE-2015-8240
534630-5 CVE-2015-5477 K16909 Upgrade BIND to address CVE 2015-5477
530829 CVE-2015-5516 K00032124 UDP traffic sent to the host may leak memory under certain conditions.
529509-5 CVE-2015-4620 K16912 BIND Vulnerability CVE-2015-4620
527799-9 CVE-2015-4000 CVE-2015-1792 CVE-2015-1791 CVE-2015-1790 CVE-2015-1789 CVE-2015-1788 CVE-2014-8176 K16674 K16915 K16914 OpenSSL library in APM clients updated to resolve multiple vulnerabilities
527630-1 CVE-2015-1788 K16938 CVE-2015-1788 : OpenSSL Vulnerability
506034-3 CVE-2014-9297 CVE-2014-9298 CVE-2014-9750 CVE-2014-9751 K16393 NTP vulnerabilities (CVE-2014-9297,CVE-2014-9298)
540849-5 CVE-2015-5986 K17227 BIND vulnerability CVE-2015-5986
540846-5 CVE-2015-5722 K17181 BIND vulnerability CVE-2015-5722
531576-1 CVE-2016-7476 K87416818 TMM vulnerability CVE-2016-7476
520466-2 CVE-2015-3628 K16728 Ability to edit iCall scripts is removed from resource administrator role
516618-5 CVE-2013-7424 K16472 glibc vulnerability CVE-2013-7424
526514-1 CVE-2016-3687 K26738102 Open redirect via SSO_ORIG_URI parameter in multi-domain SSO
522878-1 CVE-2016-3686 K82679059 Hide the cleartext Session ID (MRHSessionCookie) visible as part of URL query param to prevent unauthorized access.
515345-1 CVE-2015-1798 K16505 NTP Vulnerability


Functional Change Fixes

ID Number Severity Solution Article(s) Description
502443-4 2-Critical K16457 After enabling a blade/HA member, pool members are marked down because monitoring starts too soon.
520705-5 3-Major   Edge client contains multiple duplicate entries in server list
498992-6 3-Major   Troubleshooting enhancement: improve logging details for AWS failover failure.
471042-6 3-Major   Datastor High Velocity Traffic Pattern Changes
224903-5 3-Major K71296207 CounterBasedGauge64 MIB values do not work with Network Management Systems. The MIB should be Gauge32.


TMOS Fixes

ID Number Severity Solution Article(s) Description
544980-3 1-Blocking   BIG-IP Virtual Edition may have minimal disk space for the /var software partition when deploying from the OVA file for the Better or Best license bundle.
535806-2 1-Blocking   Not enough free disk space for live install of BIG-IP 12.0.0 from 11.5.3 VE
507312-1 1-Blocking   icrd segmentation fault
477218-5 1-Blocking   Simultaneous stats query and pool configuration change results in process exit on secondary.
473033-5 1-Blocking   Datastor Now Uses Syslog-ng
529510-2 2-Critical   Multiple Session ha state changes may cause TMM to core
523434 2-Critical K85242410 mcpd on secondary blades will restart with an error message about a sflow_http_virtual_data_source object
513454-3 2-Critical   An snmpwalk with a large configuration can take too long, causing snmpd or mcpd restarts
510979-1 2-Critical   Password-less SSH access after tmsh load of UCS may require password after install.
509503-4 2-Critical   tmsh load sys config merge file 'filename' takes signficant time for firewall rulelist configuration
507602-1 2-Critical K17166 Data packet over IPsec tunnel might be looping between cores after rekey if IPsec lifebyte is enabled
506199-4 2-Critical   VCMP guests on VDAG platforms can experience excessive tmm redirects after multiple guest provisioning cycles
504496-3 2-Critical   AAA Local User Database may sync across failover groups
497078-1 2-Critical   Modifying an existing ipsec policy configuration object might cause tmm to crash
479460-5 2-Critical   SessionDb may be trapped in wrong HA state during initialization
473105 2-Critical   FastL4 connections reset with pva-acceleration set to guaranteed
471860-3 2-Critical   Disabling interface keeps DISABLED state even after enabling
470813-1 2-Critical   Memory corruption in f5::rest::CRestServer::g_portToServerMap
468473-2 2-Critical K16193 Monitors with domain username do not save/load correctly
464870-7 2-Critical K94275315 Datastor cores and restarts.
438674-5 2-Critical K14873 When log filters include tamd, tamd process may leak descriptors
429018-2 2-Critical K17438 tmipsecd cores when deleting a non-existing traffic selector
420107-2 2-Critical   TMM could crash when modifying HTML profile configuration
364978-1 2-Critical   Active/standby system configured with unit 2 failover objects
544888-5 3-Major K17426 Idle timeout changes to five seconds when using PVA full or Assisted acceleration.
534251-1 3-Major   Live update with moving config breaks password-less ssh access
533458-4 3-Major   Insufficient data for determining cause of HSB lockup.
533257-2 3-Major   tmsh config file merge may fail when AFM security log profile is present in merged file
528881 3-Major   NAT names with spaces in them do not upgrade properly
528310 3-Major K17384 Upgrade failure when CertKeyChain exists in non-Common partition
527537 3-Major   CGNAT experiences increased CPU utilization with a high concurrent connection load and persistence enabled
527145-4 3-Major K53232218 On shutdown, SOD very infrequently cores due to an internal processing error during the shutdown.
527094-1 3-Major K17295 iControl REST: the records collection in tm/ltm/data-group/internal/ may show wrong partition and subPath metadata.
527021-1 3-Major   BIG-IQ iApp statistics corrected for empty pool use cases
526419-1 3-Major   Deleting an iApp service may fail
524791-3 3-Major   non_blocking_send/receive do not correctly handle EINTR situation for poll() == 0
524753-1 3-Major   IPsec interface is not forwarding TCP flow to the host when the destination is tunnel self-ip
524490-4 3-Major K17364 Excessive output for tmsh show running-config
524326-4 3-Major   Can delete last ip address on a gtm server but cannot load a config with a gtm server with no ips
523922-4 3-Major   Session entries may timeout prematurely on some TMMs
523125 3-Major K17350 Disabling/enabling blades in cluster can result in inconsistent failover state
520640-2 3-Major K31002924 The iControl Management.Zone.get_zone() method can return zone options in a format inconsistent for use with the Management.Zone.set_zone_option() method.
519510-3 3-Major K17164 Throughput drop and rxbadsum stat increase in tagged VLAN with LRO/GRO on BIG-IP VE running on ESX platforms with particular network hardware
519372 3-Major K55273152 vCMP guest memory growth due to large number of /var/run/tmstats-rsync.* files.
519068-3 3-Major   device trust setup can require restart of devmgmtd
518283 3-Major K16524 Cookie rewrite mangles 'Set-Cookie' headers
518039-1 3-Major   BIG-IQ iApp statistics corrected for partition use cases
517580-3 3-Major K16787 OPT-0015 on 10000-series appliance may cause bcm56xxd restarts
517178-2 3-Major K29660332 BIG-IP system as SAML Service Provider cannot process some messages from SimpleSAMLphp under certain conditions
516669-1 3-Major K34602919 Rarely occurring SOD core causes failover.
515667-4 3-Major   Unique truncated SNMP OIDs.
514726-4 3-Major K17144 Server-side DSR tunnel flow never expires
514724-1 3-Major K05364212 crypto-failsafe fail condition not cleared when crypto device restored
513916-5 3-Major K80955340 String iStat rollup not consistent with multiple blades
513294-8 3-Major   LBH firmware v3.07 update for BIG-IP 5000-/7000-series appliances
510159-1 3-Major   Outgoing MAP tunnel statistics not updated
510119-4 3-Major   HSB performance can be suboptimal when transmitting TSO packets.
509782-3 3-Major K16780 TSO packets can be dropped with low MTU
509504-5 3-Major K17500 Excessive time to save/list a firewall rule-list configuration
509037-1 3-Major K17058 BIG-IP systems allows creating wild-card IPIP tunnels with the same local-address and tunnel-type
507853-1 3-Major   MCP may crash while performing a very large chunked query and CPU is highly loaded
507575-1 3-Major   An incorrectly formated NAPTR creation via iControl can cause an error.
506041-2 3-Major K01256304 Folders belonging to a device group can show up on devices not in the group
505045-1 3-Major K56700956 MAP implementation not working with EA bits length set to 0.
504494-2 3-Major K43624250 Upgrading to 11.5.0 and later might associate a disabled HA group to traffic groups.
502238-3 3-Major K16736 Connectivity and traffic interruption issues caused by a stuck HSB transmit ring
501437-3 3-Major   rsync daemon does not stop listening after configsync-ip set to none
500234-4 3-Major   TMM may core during failover due to invalid memory access in IPsec components
499260-3 3-Major   Deleting trust-domain fails when standby IP is in ha-order
497564-2 3-Major   Improve High Speed Bridge diagnostic logging on transmit/receive failures
497304-1 3-Major   Unable to delete reconfigured HTTP iApp when auto-sync is enabled
495526-1 3-Major   IPsec tunnel interface causes TMM core at times
493246-2 3-Major K17414 SNMP error: Unknown Object Identifier (Index out of range:0 ) for sysCpuSensorSlot
493213-1 3-Major   RBA eam and websso daemons segfaulting while provisioning
491716-2 3-Major   SNMP attribute type incorrect for certain OIDs
491556-7 3-Major K16573 tmsh show sys connection output is corrected
489084-1 3-Major   Validation error in MCPD for FQDN nodes
484706-2 3-Major K16460 Incremental sync of iApp changes may fail
483104-3 3-Major K17365 vCMP guests report platform type as 'unknown'
481648-8 3-Major   mib-2 ipAddrTable interface index does not correlate to ifTable
480679-1 3-Major K16858 The big3d daemon does not receive config updates from mcpd
473348-6 3-Major K16654 SNMP hbInterval value not set to 300 sec after upgrade from 11.2.x to 11.3.0 or later
473088-4 3-Major K17091 Virtual server with RequestAdapt/ResponseAdapt profiles along with a OneConnect profile
470756-6 3-Major   snmpd cores or crashes with no logging when restarted by sod
468837-5 3-Major   SNAT translation traffic group inheritance does not sync across devices
464252-2 3-Major   Possible tmm crash when modifying html pages with HTML profile.
464024-4 3-Major K16455 File descriptor leak when running some TMSH commands through scriptd
458104-3 3-Major K16795 LTM UCS load merge trunk config issue
455264-3 3-Major K54105052 Error messages are not clear when adding member to device trust fails
442871-1 3-Major K17185 BIG-IP VE instances created using OpenStack interfaces may fail to detect the KVM hypervisor
441297-3 3-Major K16493 Trunk remains down and interface's status is 'uninit' after mcpd restart
416388-1 3-Major   vCMPD will not reattach to guest
410398-3 3-Major   sys db tmrouted.rhifailoverdelay does not seem to work
405752-1 3-Major K22040410 TCP Half Open monitors sourced from specific source ports can fail
383784-5 3-Major K17289 Remote Auth user names containing blank space cannot login through TMSH.
362267-3 3-Major K17488 Configuring network failover on a VIPRION cluster using the blade management addresses results in 'Cannot assign requested address' errors
359774-6 3-Major   Pools in HA groups other than Common
355661-3 3-Major K85476133 sod logs error 010c003b:3: bind fails on recv_sock_fd, Cannot assign requested address
524606-1 4-Minor   SElinux violations prevent cpcfg from touching /service/mcpd/forceload
524185 4-Minor   Unable to run lvreduce
523863-2 4-Minor   istats help not clear for negative increment
492163-3 4-Minor K12400 Applying a monitor to pool and pool member may cause an issue.
475647-2 4-Minor   VIPRION Host PIC firmware version 7.02 update
473163-2 4-Minor   RAID disk failure and alert.conf log message mismatch results in no trap
471827-1 4-Minor   Firstboot early syslog-ng log: /var/run/httpd.pipe does not exist
465675-3 4-Minor K07816405 Invalid MAX-ACCESS clause for deprecated variables: ltmNodeAddrNewSessionEnable and ltmPoolMemberNewSessionEnable.
465317-1 4-Minor K10890804 Failure notice from '/usr/bin/set-rsync-mgmt-fw close' seen on each boot.
464043-3 4-Minor   Integration of Firmware for the 2000 Series Blades
443298-2 4-Minor   FW Release: Incorporate VIPRION 2250 LOP firmware v1.20
356658-2 5-Cosmetic K28234602 Message logged when remote authenticated users do not have local account login


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
522784-2 1-Blocking   After restart, system remains in the INOPERATIVE state
420341-6 1-Blocking K17082 Connection Rate Limit Mode when limit is exceeded by one client also throttles others
552937-1 2-Critical   HTTP::respond or HTTP::redirect in a non-HTTP iRule event can cause the next pipelined request to fail.
539344-1 2-Critical   SPDY child flow aborted while stalled leaves freed SPDY stream in SPDY stalled list
538255 2-Critical   SSL handshakes on 4200/2200 can cause TMM cores.
533388-1 2-Critical   tmm crash with assert "resume on different script"
530963-4 2-Critical   BIG-IP TLS doesn't correctly verify Finished.verify_data on non-Cavium platforms
528432-2 2-Critical   Control plane CPU usage reported too high
523079-2 2-Critical   Merged may crash when file descriptors exhausted
514108-1 2-Critical   TSO packet initialization failure due to out-of-memory condition.
510837-2 2-Critical   Server initiated renegotiation fails with dhe_dss/ecdhe_ecdsa and ecdh_ecdsa ciphers. BIG-IP sends bad client key exchange.
509346-2 2-Critical K01051264 Intermittent or complete SSL handshake failure with netHSM keys
506304-2 2-Critical   UDP connections may stall if initialization fails
505331-1 2-Critical K17092 SASP Monitor may core
505222-2 2-Critical   DTLS drops egress packets when traffic is large
503343-7 2-Critical   TMM crashes when cloned packet incorrectly marked for TSO
499422-1 2-Critical K31310380 An optimistic ACK sent by a server in response to a BIG-IP FIN/ACK packet result in a FIN/ACK storm.
497299-5 2-Critical   Thales install fails if the BIG-IP system is also configured as the RFS
492352-3 2-Critical   SSL profiles using password protected SSL keys cause config utility error
481677-2 2-Critical   A possible TMM crash in some circumstances.
481162-2 2-Critical K16458 vs-index is set differently on each blade in a chassis
474601-5 2-Critical   FTP connections are being offloaded to ePVA
450814-10 2-Critical   Early HTTP response might cause rare 'server drained' assertion
431283-7 2-Critical   iRule binary scan may core TMM when the offset is large
426328-8 2-Critical K14654 Updating iRule procs while in use can cause a core
402412-8 2-Critical   FastL4 tcp handshake timeout is not honored, connection lives for idle timeout.
551612 3-Major   BIG-IP SSL does not support sending multiple certificate verification requests to the hardware accelerator at the same time in 11.6.0.
530431 3-Major K17537 FQDN nodes: ephemeral nodes not being created for resolved FQDN hosts
526810-5 3-Major   Crypto accelerator queue timeout is now adjustable
525557 3-Major   FQDN ephemeral nodes not re-populated after deleted and re-created
524666-3 3-Major   DNS licensed rate limits might be unintentionally activated.
522147-2 3-Major   'tmsh load sys config' fails after key conversion to FIPS using web GUI
521774-3 3-Major K17420 Traceroute and ICMP errors may be blocked by AFM policy
521538-2 3-Major K08025400 Keep-alive transmissions do not resume after failover of flows on an L4 virtual, when the sequence number is known
521522-3 3-Major K21981142 Traceroute through BIG-IP may display destination IP address at BIG-IP hop
521408-3 3-Major   Incorrect configuration in BigTCP Virtual servers can lead to TMM core
520540-1 3-Major   Specific iRule commands may generate a core file
518020-11 3-Major K16672 Improved handling of certain HTTP types.
517790-1 3-Major   When non-HTTP traffic causes the server-side to receive unexpected data, the connection will be dropped
517556-3 3-Major   DNSSEC unsigned referral response is improperly formatted
516598-1 3-Major K82721850 Multiple TCP keepalive timers for same Fast L4 flow
516320-2 3-Major   TMM may have a CPU spike if match cross persist is used.
515817-2 3-Major   TMM may not reset connection when receiving an ICMP error
515322-1 3-Major   Intermittent TMM core when using DNS cache with forward zones
515072-4 3-Major K17101 Virtual servers with priority groups reset incoming connections when a non-zero connection limit is increased
514246-3 3-Major   connflow_precise_check_begin does not check for NULL
512383-3 3-Major K68275911 Hardware flow stats are not consistently cleared during fastl4 flow teardown.
512148-1 3-Major K17154 Self IP address cannot be deleted when its VLAN is associated with static route
512062-2 3-Major K21528300 A db variable to disable verification of SCTP checksum when ingress packet checksum is zero
510921-1 3-Major K23548911 Database monitors do not support IPv6 nodes
510720-1 3-Major K81614705 iRule table command resumption can clear the header buffer before the HTTP command completes
510638-1 3-Major K37513511 [DNS] Config change in dns cache resolver does not take effect until tmm restart
507529-1 3-Major   Active crash with assert: tmm failed assertion, non-zero ha_unit required for mirrored flow
506282-1 3-Major K16168 GTM DNSSEC keys generation is not sychronized upon key creation
505059-1 3-Major   Some special characters are not properly handled for username and password fields in TCL monitors
504899-2 3-Major   Duplicated snat-translation addresses are possible (a named and an anonymous (created by snatpool) one)
504306-2 3-Major   https monitors might fail to re-use SSL sessions.
504105-4 3-Major   RR-DAG enabled UDP ports may be used as source ports for locally originated traffic
503979-1 3-Major   High CPU usage when DNS cache resolver sends a large number of DNS queries to the backend name server.
503384-1 3-Major K17394 SMTP monitor fails on multi line greeting banner in SMTP server
501516-5 3-Major   If a very large number of monitors is configured, bigd can run out of file descriptors when it is restarted.
497742-3 3-Major   Some TCP re-transmits on translucent vlangroup skip bit-flip on source MAC address
496758-5 3-Major K16465 Monitor Parameters saved to config in a certain order may not construct parameters correctly
495836-2 3-Major   SSL verification error occurs when using server side certificate.
495557-1 3-Major   Ephemeral node health status may report as 'unknown' rather than the expected 'offline'
490713-3 3-Major   FTP port might occasionally be reused faster than expected
490429-2 3-Major K17206 The dynamic routes for the default route might be flushed during operations on non-default route domains.
488600-2 3-Major   iRule compilation fails on upgrade
488581 3-Major K17539 The TMM process may restart and produce a core file when using the SSL::disable clientside iRule command within a HTTP_REQUEST event
485472-3 3-Major   iRule virtual command allows for protocol mismatch, resulting in crash
479674-1 3-Major K16629 bigd crash on improper monitor configuration (timeout less than the interval) for Tcl monitors.
478617-6 3-Major K16451 Don't include maximum TCP options length in calculating MSS on ICMP PMTU.
478439-6 3-Major K16651 Unnecessary re-transmission of packets on higher ICMP PMTU.
478257-7 3-Major   Unnecessary re-transmission of packets on ICMP notifications even when MTU is not changed
476097-1 3-Major K15274113 TCP Server MSS option is ignored in verified accept mode
474356-1 3-Major   Client SSL on partition other than /Common does not load if no key/cert/inherit-certkeychain
471059-4 3-Major   Malformed cookies can break persistence
465607-7 3-Major K15966 TMM cores with TMM log error 'Assertion "flow in use" failed.' when isuing FastHTTP.
465590-9 3-Major K17531 Mirrored persistence information is not retained while flows are active
465052-6 3-Major K16060 Some HTTP::cookie iRule commands can cause TMM to core if required arguments are missing
462714-2 3-Major K66236389 Source address persistence record times out even while traffic is flowing on FastL4 profile virtual server
460627-3 3-Major K17059 SASP monitor starts a new connection to the Group Workload Manager (GWM) server when a connection to it already exists
447874-5 3-Major   TCP zero window suspends data transfer
447043-3 3-Major K17095 Cannot have 2 distinct 'contains' conditions on the same LTM policy operand
422107-8 3-Major K17415 Responses from DNS transparent cache will no longer contain RRSIG for queries without DO bit set
422087-5 3-Major K16326 Low memory condition caused by Ram Cache may result in TMM core
375887-4 3-Major K17282 Cluster member disable or reboot can leak a few cross blade trunk packets
374339-4 3-Major   HTTP::respond/redirect might crash TMM under low-memory conditions
364994-7 3-Major K16456 TMM may restart or disabled connections may be reused when a OneConnect profile is configured and OneConnect reuse is disabled be an iRule.
352925-2 3-Major K16288 Updating a suspended iRule and TMM process restart
348000-1 3-Major   HTTP response status 408 request timeout results in error being logged.
342013-6 3-Major K27445955 TCP filter doesn't send keepalives in FIN_WAIT_2
226892-13 3-Major K12831 Packet filter enabled, default action discard/reject and IP fragment drop
486485-1 4-Minor   TCP MSS is incorrect after ICMP PMTU message.
454692-4 4-Minor K16235 Assigning 'after' object to a variable causes memory leaks
442647-5 5-Cosmetic K04311130 IP::stats iRule command reports incorrect information past 2**31 bits


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
515797-1 2-Critical   Using qos_score command in RULE_INIT event causes TMM crash
513464-1 2-Critical   Some autodiscovered virtuals may be removed from pools.
471819-2 2-Critical   The big3d agent restarts periodically when upgrading the agent on a v11.4.0 or prior system and Common Criteria mode is enabled.
517083-1 3-Major   Some autodiscovered virtuals may be removed from pools.
516685-2 3-Major   ZoneRunner might fail to load valid zone files.
516680-2 3-Major   ZoneRunner might fail when loading valid zone files.
515033 3-Major   [ZRD] A memory leak in zrd
515030-1 3-Major K74820030 [ZRD] A memory leak in Zrd
496775-3 3-Major K16194 [GTM] [big3d] Unable to receive mark LTM virtual server up if there is another VS with same ltm_name for the bigip monitor
479142-1 3-Major K16173 Deleting a virtual server does not delete the resource record (RR) in ZoneRunner Daemon (ZRD)
465951-2 3-Major K12562945 If net self description size =65K, gtmd restarts continuously
479084-1 4-Minor   ZoneRunner can fail to respond to commands after a VE resume.
353556-4 4-Minor   big3d https monitor is unable to correctly monitor the web server when SSL protocol is changed


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
524428-1 2-Critical   Adding multiple signature sets concurrently via REST
524004-1 2-Critical   Adding multiple signatures concurrently via REST
520280-1 2-Critical   Perl Core After Apply Policy Action
513822-1 2-Critical   ASM REST: Expected Content Value Is Not Set When Setting The responseActionType For A Response Page
511196-1 2-Critical   UMU memory is not released when remote logger can't reach its detination
532030-3 3-Major   ASM REST: Custom Signature Set Created via REST is Different Than When Created From GUI
531539-1 3-Major K05113177 The NTLM login is not recognized as failed login.
527861 3-Major   When Many entities are displayed on the "Illegal Meta Character in Value" manual traffic learning screen, the Configuration utility becomes unresponsive.
526856-1 3-Major   "Use of uninitialized value" warning appears on UCS installation due to ASM signature inconsistency
523261-1 3-Major   ASM REST: MCP Persistence is not triggered via REST actions
523260-1 3-Major K52028045 Apply Policy finishes with coapi_query failure displayed
523201-2 3-Major   Expired files are not cleaned up after receiving an ASM Manual Synchronization
520585-2 3-Major   Changing Security Policy Application Language Is Not Validated or Propagated Properly
519053-1 3-Major   Request is forwarded truncated to the server after answering challenge on a big request
516522-1 3-Major K04420402 After upgrade from any pre-11.4.x to 11.4.x through 12.0.0, the configured redirect URL location is empty.
486829-1 3-Major K17512 HTTP Protocol Compliance options should not be modified during import/upgrade
467930-1 3-Major K47335122 Searching ASM Request Log for requests with specific violations
514117-1 4-Minor   Store source port higher than 32767 in Request Log record


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
531526-2 3-Major K17560 Missing entry in SQL table leads to misleading ASM reports
530356-2 3-Major   Some AVR tables that hold ASM statistics are not being backed up in upgrade process.
526277-1 3-Major   AFM attack may never end on AVR dos overview page in a chassis based BIG-IP
525708-1 3-Major K17555 AVR reports of last year are missing the last month data
519022-2 3-Major K01334306 Upgrade process fails to convert ASM predefined scheduled-reports.
518663-1 3-Major   Client waits seconds before page finishes load
499315-1 3-Major   Added "Collect full URL" functionality.
485251-1 3-Major   AVR core witch include tmstat backtrace
479334-5 3-Major K16894 monpd/ltm log errors after Hotfix is applied
472117-2 3-Major   Analytics scheduled report: "predefinedReportName" and "multiLeveledReport" are mutually exclusive


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
492149-3 1-Blocking   Inline JavaScript with HTML entities may be handled incorrectly
488736-5 1-Blocking   Fixed problem with iNotes 9 Instant Messaging
482266-3 1-Blocking   Windows 10 support for Network Access / BIG-IP Edge Client
482241-1 1-Blocking   Windows 10 cannot be properly detected
439880-2 1-Blocking   NTLM authentication does not work due to incorrect NetBIOS name
405769-3 1-Blocking   APM Logout page is not protected against CSRF attack.
532340-1 2-Critical   When FormBased SSO or SAML SSO are configured, tmm may restart at startup
526754-2 2-Critical   F5unistaller.exe crashes during uninstall
525562-1 2-Critical   Debug TMM Crashes During Initialization
523313-1 2-Critical K17574 aced daemon might crash on exit
520298-2 2-Critical   Java applet does not work
520145-3 2-Critical   [Policy Sync] OutOfMemoryError exception when syncing big and complex APM policy
519864-3 2-Critical   Memory leak on L7 Dynamic ACL
518260-1 2-Critical   Missing NTLMSSP_TARGET_INFO flag on NTLMSSP_CHALLENGE message
517988-2 2-Critical   TMM may crash if access profile is updated while connections are active
514220-1 2-Critical   New iOS-based VPN client may fail to create IPv6 VPN tunnels
509490-2 2-Critical   [IE10]: attachEvent does not work
507681-5 2-Critical   Window.postMessage() does not send objects in IE11
506223-2 2-Critical   A URI in request to cab-archive in iNotes is rewritten incorrectly
502269-1 2-Critical   Large post requests may fail using form based SSO.
493993-6 2-Critical K15914 TMM crashes on the standby when starting up in HA config and Active processing traffic in APM module
492287-1 2-Critical   Support Android RDP client 8.1.3 with APM remote desktop gateway
480272-6 2-Critical K17117 During OAM SDK initialization, ObConfig initialization returns wrong accessgate ID
540778-3 3-Major   Multiple SIGSEGV with core and failover with no logged indicator
539013-6 3-Major   DNS resolution does not work on a Windows 10 desktop with multiple NICs after VPN connection has been established in some cases
537614-1 3-Major   Machine certificate checker fails to use Machine cert check service if Windows has certain display languages
537000-2 3-Major   Installation of Edge Client can cause Windows 10 crash in some cases
534755-1 3-Major   Deleting APM virtual server produces ERR_NOT_FOUND error
533566-1 3-Major   Support for View HTML5 client v3.5 shipped with VCS 6.2
532761 3-Major   APM fails to handle compressed ICA file in integration mode
532096-2 3-Major   Machine Certificate Checker is not backward compatible with 11.4.1 (and below) when MatchFQDN rule is used
531910-1 3-Major   apmd, apd, localmgr random crash
531883-2 3-Major   Windows 10 App Store VPN Client must be detected by BIG-IP APM
531541-1 3-Major   Support Citrix Receiver 4.3 for Windows in PNAgent mode
531529-1 3-Major   Support for StoreFront proxy
531483-2 3-Major   Copy profile might end up with error
530800-1 3-Major   Messages can't be sent from OWA2010 via Portal Access if form-based SSOv2 is in use.
530773 3-Major   per-request policy logs frequently in apm logs
530697-2 3-Major   Windows Phone 10 platform detection
529392-2 3-Major   Win10 and IE11 is not determined in case of DIRECT rule of proxy autoconfig script
528768-1 3-Major   Relaxing validation against "_" character for ActiveDirectory server FQDN for NTLM authentication
528727-1 3-Major   In some cases HTML body.onload event handler is not executed via portal access.
528726-3 3-Major   AD/LDAP cache size reduced
528675-2 3-Major   BIG-IP EDGE Client can indefinitely stay "disconnecting..." state when captive portal session expired
526677-1 3-Major   VMware Horizon HTML5 View access client can not connect when using View Connection Server running version 6.1.1
526617-1 3-Major   TMM crash when logging a matched ACL entry with IP protocol set to 255
526578-1 3-Major   Network Access client proxy settings are not applied on German Windows
526492-2 3-Major   DNS resolution fails for Static and Optimized Tunnels on Windows 10
526275-1 3-Major   VMware View RSA/RADIUS two factor authentication fails
526084-3 3-Major   Windows 10 platform detection for BIG-IP EDGE Client
525384-2 3-Major   Networks Access PAC file now can be located on SMB share
524909-2 3-Major   Windows info agent could not be passed from Windows 10
523431-2 3-Major   Windows Cache and Session Control cannot support a period in the access profile name
523390-2 3-Major   Minor memory leak on IdP when SLO is configured on bound SP connectors.
523327-2 3-Major   In very rare cases Machine Certificate service may fail to find private key
523305-1 3-Major   Authentication fails with StoreFront protocol
523222-6 3-Major   Citrix HTML5 client fails to start from Storefront in integration mode when Access Policy is configured with Redirect ending.
521835-2 3-Major   [Policy Sync] Connectivity profile with a customized logo fails
521773-2 3-Major K10105099 Memory leak in Portal Access
521506-2 3-Major   Network Access doesn't restore loopback route on multi-homed machine
520642-3 3-Major   Rewrite plugin should check length of Flash files and tags
520390-1 3-Major   Reuse existing option is ignored for smtp servers
520205-3 3-Major   Rewrite plugin could crash on malformed ActionScript 3 block in Flash file
520118-2 3-Major   Duplicate server entries in Server List.
519966-2 3-Major   APM "Session Variables" report shows user passwords in plain text
519415-3 3-Major   apm network access tunnel ephemeral listeners ignore irules (related-rules from main virtual )
519198-3 3-Major   [Policy Sync] UI General Exception Error when sync a policy in non-default partition as non-default admin user
518981-2 3-Major   RADIUS accounting STOP message may not include long class attributes
518583-2 3-Major   Network Access on disconnect restores redundant default route after looped network roaming for Windows clients
518573 3-Major   The -decode option should be added to expressions in AD and LDAP group mapping.
518432 3-Major   [Mac][Linux][NA] TLS tunnel freezes on Mac and Linux in case of SSL renegotiation
517564-1 3-Major   APM cannot get groups from an LDAP server, when LDAP server is configured to use non-default port
517441-5 3-Major   apd may crash when RADIUS accounting message is greater than 2K
516839-3 3-Major   Add client type detection for Microsoft Edge browser
516462-2 3-Major   Gateways for excluded address space routes are not adjusted correctly during roaming between networks on Windows machines
515943-2 3-Major   "Session variables" report may show empty if session variable value contains non-English characters
514912-3 3-Major   Portal Access scripts had not been inserted into HTML page in some cases
513969-3 3-Major   UAC prompt is shown for machine cert check for non-limited users, even if machine cert check service is running
513953-1 3-Major K17122 RADIUS Auth/Acct might fail if server response size is more than 2K
513706-2 3-Major K16958 Incorrect metric restoration on Network Access on disconnect (Windows)
513545-1 3-Major   '-decode' option produce incorrect value when it decodes a single value
513283-1 3-Major   Mac Edge Client doesnt send client data if access policy expired
513098-1 3-Major K17180 localdb_mysql_restore.sh failed with exit code
512345-2 3-Major K17380 Dynamic user record removed from memcache but remains in MySQL
512245-7 3-Major   Machine certificate agent on OS X 10.8 and OS X 10.9 uses local host name instead of hostname
511854-4 3-Major K85408112 Rewriting URLs at client side does not rewrite multi-line URLs
510709-1 3-Major   Websso start URI match fails if there are more than 2 start URI's in SSO configuration.
509722-1 3-Major   BWC traffic blocked
509677-1 3-Major   Edge-client crashes after switching to network with Captive Portal auth
504031-1 3-Major   document.write()/document.writeln() redefinition does not work
501494-1 3-Major   if window.onload is assigned null, then null should be retrieved
500938-3 3-Major   Network Access can be interrupted if second NIC is disconnected
500450-1 3-Major   ASM and APM on same virtual server caused Set-Cookie header modification done by ASM not honored by APM websso.
495336-1 3-Major K39768154 Logon page is not displayed correctly when 'force password change' is on for local users.
494637-2 3-Major K80550446 localdbmgr process in constant restart/core loop
494565-4 3-Major K65181614 CSS patcher crashes when a quoted value consists of spaces only
493023-3 3-Major   Export of huge policies might ends up with 'too many pipes opened' error
492701-3 3-Major   Resolved LSOs are overwritten by source device in new Policy Sync with new LSO
492305-1 3-Major   Recurring file checker doesn't interrupt session if client machine has missing file
490830-4 3-Major   Protected Workspace is not supported on Windows 10
488105-3 3-Major   TMM may generate core during certain config change.
483792-5 3-Major   when iSession control channel is disabled, don't assign app tunnel, MSRDP, opt tunnel resources
483501-1 3-Major   Access policy v2 memory leak during object deletion in tmm.
483286-3 3-Major   APM MySQL database full as log_session_details table keeps growing
483020-1 3-Major K17533 [SWG] Policy execution hang when using iRule event in VPE
482699-4 3-Major   VPE displaying "Uncaught TypeError"
482251-3 3-Major K95824957 Portal Access. Location.href(url) support.
481987-6 3-Major   Allow NTLM feature to be enabled with APM Limited license
481663-5 3-Major   Disable isession control channel on demand.
480761-1 3-Major   Fixed issue causing TunnelServer to crash during reconnect
478751-6 3-Major K35826411 OAM10g form based AuthN is not working for a single/multiple domain.
478492-7 3-Major K17476 Incorrect handling of HTML entities in attribute values
475735-4 3-Major K30145457 Failed to load config after removing peer from sync-only group
475403-2 3-Major   Tunnel reconnect with v2.02 does not occur
474779-1 3-Major   EAM process fails to register channel threads (MPI channel) with TMM, and subsequent system call fails.
473488-6 3-Major K17376 In AD Query agent, resolving of nested groups may cause apd to spin
473255-3 3-Major K41869058 Javascript sibmit() method could be rewritten incorrectly inside of 'with' statement.
472256-3 3-Major K17259 tmsh and tmctl report unusually high counter values
472062-3 3-Major K17480 Unmangled requests when form.submit with arguments is called in the page
471117-4 3-Major K17546 iframe with JavaScript in 'src' attribute not handled correctly in IE11
468137-6 3-Major   Network Access logs missing session ID
466745-3 3-Major   Cannot set the value of a session variable with a leading hyphen.
462514-1 3-Major K91196715 Support for XMLHttpRequest is extended
461189-5 3-Major K16563 Generated assertion contains HEX-encoded attributes
458450-2 3-Major K16941 The ECA process may produce a core file when processing HTTP headers
457760-5 3-Major   EAM not redirecting stdout/stderr from standard libraries to /var/log/apm
452010-3 3-Major K16609 RADIUS Authentication fails when username or password contain non-ASCII characters
446860-4 3-Major   APM Exchange Proxy does not honor tmm.access.maxrequestbodysize DB variable and is subject to ID 405348
442698-10 3-Major   APD Active Directory module memory leak in exception
431467-1 3-Major   Mac OS X support for nslookup and dig utilities to use VPN DNS
426209-2 3-Major   exporting to a CSV file may fail and the Admin UI is inaccessible
423282-8 3-Major K17116 BIG-IP JavaScript includes can be improperly injected in case of conditional commment presence
408851-7 3-Major   Some Java applications do not work through BIG-IP server
402793-12 3-Major   APM Network Accces tunnel slows down and loses data in secure renegotiation on Linux and Mac clients
340406-10 3-Major   Localization of BIG-IP Edge Client for Macintosh
533723-4 4-Minor   [Portal Access] Client side HTML rewriter should not rewrite content within "textarea" tag.
524756 4-Minor   APM Log is filled with errors about failing to add/delete session entry
523158-2 4-Minor   In vpe if the LDAP server returns "cn=" (lower case) dn/group match fails
517872-1 4-Minor   Include proxy hostname in logs in case of name resolution failure
513201-6 4-Minor   Edge client is missing localization of some English text in Japanese locale
510459-1 4-Minor   In some cases Access does not redirect client requests
507321-3 4-Minor   JavaScript error if user-defined object contains NULL values in 'origin' and/or 'data' fields
497627-3 4-Minor K58125050 Tmm cores while using APM network access and no leasepool is created on the BIG-IP system.
486661-3 4-Minor   Network Access should provide client IP address on reconnect log records
482145-3 4-Minor   Text in buttons not centered correctly for higher DPI settings
478658-6 4-Minor   Window.postMessage() does not send objects
478261-2 4-Minor   WinInet handle leak in Edge Client on Windows
473685-1 4-Minor   Websso truncates cookie domain value


WebAccelerator Fixes

ID Number Severity Solution Article(s) Description
522231-3 3-Major   TMM may crash when a client resets a connection
521455-2 3-Major K16963 Images transcoded to WebP format delivered to Edge browser


Wan Optimization Manager Fixes

ID Number Severity Solution Article(s) Description
497389-1 3-Major   Extraneous dedup_admin core
485182-2 3-Major K19303084 wom_verify_config does not recognize iSession profile in /Common sub-partition
480910 3-Major   A TCP profile with 'Rate Pace" or 'Tail Loss Probe' enabled fails to successfully establish a connection.
442884-1 3-Major   TMM assert "spdy pcb initialized" in spdy_process()


Service Provider Fixes

ID Number Severity Solution Article(s) Description
521556-1 2-Critical   Assertion "valid pcb" in TCP4 with ICAP adaptation
516057-3 2-Critical K17440 Assertion 'valid proxy' can occur after a configuration change with active IVS flows.
503652-4 2-Critical K17162 Some SIP UDP connections are lost immediately after enabling a blade on the Active HA unit.
480311-1 3-Major K47143123 ADAPT should be able to work with OneConnect
489957-5 4-Minor   RADIUS::avp command fails when AVP contains multiple attribute (VSA).
478920 4-Minor   SIP::discard is not invoked for all request messages


Advanced Firewall Manager Fixes

ID Number Severity Solution Article(s) Description
524748-1 2-Critical   PCCD optimization for IP address range
506286-1 2-Critical   TMSH reset of DOS stats
534886-1 3-Major   AFM Security checks were not being done for DNS over TCP
532022-1 3-Major   tmm can crash when the reply pkt to a service flow request is a DoS pkt
531761-1 3-Major   Web navigation flow may be reset when main page responds with non-HTML content
530865-2 3-Major   AFM Logging regression for Global/Route Domain Rules incorrectly using virtual server logging profile (if it exists)
526774 3-Major   Search in FW policy disconnects GUI users
525522 3-Major   Redirect loop when Proactive Bot Defense is enabled and deployment has multiple domains
523465-2 3-Major   Log an error message when firewall rule serialization fails due to maximum blob limit being hit.
521763-1 3-Major   Attack stopped and start messages should not have source/dst ip addresses in log messages
515112-1 3-Major   Delayed ehash initialization causes crash when memory is fragmented.
510224-2 3-Major   All descriptions for address-list members are flushed after the address-list was updated
509934-1 3-Major   Blob activation fails due to counter revision
509919-2 3-Major   Incorrect counter for SelfIP traffic on cluster
509600-1 3-Major   Global rule association to policy is lost after loading config.
481706-2 3-Major   AFM DoS Sweep Vector could log attack detected msgs from a non-attacking src IP
533808-1 4-Minor   Unable to create new rule for virtual server if order is set to "before"/"after"
533336-2 4-Minor   Display 'description' for port list members
528499 4-Minor   AFM address lists are not sorted while trying to create a new rule.
510226-2 4-Minor   All descriptions for ports-list's members are flushed after the port-list was updated
491165-1 4-Minor   Legal IP addresses sometimes logged in Attack Started/Stopped message.
495432-2 5-Cosmetic   Add new log messages for AFM rule blob load/activation in datapath.


Policy Enforcement Manager Fixes

ID Number Severity Solution Article(s) Description
545558-1 1-Blocking   Send RAA when RAR is sent by PCRF and session is deleted immediately after its created.
533929 1-Blocking   PEM::subscriber info irule command can cause tmm core
525175-1 1-Blocking   Fix a crash issue when querying SSP with multi-ip.
524780-1 1-Blocking   TMM crash when quering the session information
522933-1 1-Blocking   diam_app_process_async_lookup may cause TMM crash
534490 2-Critical   Fixed TMM crash when iRule configuration is modified.
534018-1 2-Critical   Memory leak while running some of PEM::session and PEM::subscriber commands.
533734-1 2-Critical K82536069 DHCPv6 packets arriving via tunnel are not forwarded to backend server on VIPRION
533203 2-Critical K98322810 TMM may core on resuming iRule if the underlying flow has been deleted.
528715-1 2-Critical   rare tmm crash when ipother irule parks
527016-1 2-Critical   CLASSIFICATION_DETECTED irule event results in tmm core
524374-1 2-Critical   TMM may crash if PEM report format script with iRule are executed on top of existing parked iRule
523296-1 2-Critical   TMM may core when using iRule custom actions in PEM policies
519506-1 2-Critical   Flows dropped with initiate data from sever on virtual servers with HTTP
491771-2 2-Critical   Parking command called from inside catch statement
541592-1 3-Major   PEM : Diameter virtual reconfiguration might stop CCR-I/U/T going out for subscriber sessions
537034 3-Major K13145204 PEM: CPU spike seen when iRule tries to update nonexistent sessions.
534323-1 3-Major   Session will be replaced rather than re-created when we update a new IP addr along with the existing IP addr.
533513-1 3-Major   Data plane Listener summary does not show LSN translation correctly
529414-1 3-Major   PEM: After Diameter Fatal-Grace time expiry, Some subscriber sessions might be deleted very soon
528787-1 3-Major   PEM: RAR after session being deleted from Radius/TMSH when connection down will return RAA with success code.
528247-1 3-Major   PEM: New Requested units empty for when used units matches granted service units
528238-1 3-Major   Quota Policy Added multiple times will lead to reset of Subscriber flows
527725-1 3-Major   BIG-IP crash caused by PSC::ip_address iRule is fixed
527292-1 3-Major   BIG-IP crash caused by PSC::user_name iRule is fixed
527289-1 3-Major   TMM crashes with core when PSC::ip_address iRule is used to list IPs
527076-1 3-Major   TMM crashes with core when PSC::policy iRule is used to set more than 32 policies
526786-1 3-Major   Session lookup fails
526368-1 3-Major   The number of IPv4 addresses per Gx session exceeds the limit of 1
526295-3 3-Major   BIG-IP crashes in debug mode when using PEM iRule to create session with calling-station-id and called-station-id
525860-2 3-Major   PEM: Duplicate sessions formed with same IP
525633-1 3-Major K02093894 Configurable behavior if PCRF returns unknown session ID in middle of session.
525416-1 3-Major   List of IPs in "tmsh show pem sessiondb subscriber-id " may be reversed.
524409-1 3-Major   Fix TMSH show and reset-stats commands for multi-ip sessions defect.
524198-1 3-Major   PEM: Invalid HSL log generated when when session with static subscriber deleted.
522934 3-Major   Provide and option to encode subscription ID in CCR-U/CCR-T messages over Gx/Gy
522579-1 3-Major   TMM memory leak when RAR messages received from PCRF to delete for a non-existing sessions in PEM
522141-1 3-Major   Tmm cores while changing properties of PEM policies and rules.
522140-1 3-Major   Multiple IP is not added through iRule after setting the state of a session to provision by iRule
521683-1 3-Major   PEM: Session is not replaced by third and subsequent RADIUS start messages containing specific multiple IPs
521655-2 3-Major   Session hangs when trying to switch state to provisioned
504627-1 3-Major   Valid RADIUS sessions deleted on no session inactivity if no subscriber traffic exists during session timeout period.
499778-1 3-Major   A static subscriber's session is not deleted if master-IP is deleted from the subscriber's list of IPs
471926-1 3-Major   Static subscriber sessions lost after bigstart restart
539677-1 4-Minor   The file /etc/wr_urldbd/bcsdk.cfg needs to be included in the .ucs file


Carrier-Grade NAT Fixes

ID Number Severity Solution Article(s) Description
533562-1 2-Critical K15320373 Memory leak in CGNAT can result in crash
515646-1 2-Critical K17339 TMM core when multiple PPTP calls from the same client
509108-1 2-Critical   CGNAT PBA may log port-block allocation and port-block release log messages for a port-block which is already allocated to a different subscriber
494743-1 2-Critical K17389 Port exhaustion errors on VIPRION 4800 when using CGNAT
494122-2 2-Critical K02533962 Deterministic NAT state information from HSL is not usable on VIPRION B4300 blades
490893-4 2-Critical K16762 Determinstic NAT State information incomplete for HSL log format
505097-1 3-Major   lsn-pool backup-member not propagated to route table after tmrouted restart
504021-1 3-Major   lsn-pool member routes not properly propagated to routing table when lsn-pool routing-advertisement is enabled
500424-2 3-Major   dnatutil exits when reverse mapping one of the snippet results in "No tmms on the blade" error
486762-1 3-Major K05172346 lsn-pool connection limits may be invalid when mirroring is enabled
480119-2 3-Major K16112 Vague error - Error ERR_BOUNDS connflow ... processing pullup of control message.
455020-1 3-Major   RTSP profile idle timeout is not applied if it is longer than the TCP profile timeout


Fraud Protection Services Fixes

ID Number Severity Solution Article(s) Description
526124 2-Critical   Parameter matching inconsistency
520090-1 2-Critical K17546 Flows are closed as expired rather than closed gracefully.
529573 3-Major   CSS attribute name
527075 3-Major   Update domain availability default settings
525283-1 3-Major   Add obfuscator tuning tools
524032-1 3-Major   Control sending alerts during the source integrity learning process
513860-1 3-Major   Incomplete support for special characters in input field names
503461-1 3-Major K88491629 Intermittent JavaScript failure on Safari on Macintosh computer or device.
529587 4-Minor   Errornous JS injections


Global Traffic Manager (DNS) Fixes

ID Number Severity Solution Article(s) Description
514236-1 3-Major   [GUI][GTM] GUI does not prefix partition to device-name for BIG-IP DNS Server IP addresses


Device Management Fixes

ID Number Severity Solution Article(s) Description
525595 1-Blocking K38134424 Memory leak of inbound sockets in restjavad.
509273 2-Critical   hostagentd consumes memory over time
533307 3-Major   Increasing memory usage due to continual creation of authentication tokens
521272 3-Major K16751 Fixed memory leak in restjavad's Authentication Token worker


iApp Technology Fixes

ID Number Severity Solution Article(s) Description
495525-1 4-Minor   iApps fail when using FQDN nodes in pools



Cumulative fixes from BIG-IP v11.6.0 Hotfix 5 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
523032-6 CVE-2015-3456 K16620 qemu-kvm VENOM vulnerability CVE-2015-3456
513034-1 CVE-2015-4638 K17155 TMM may crash if Fast L4 virtual server has fragmented packets
511651-3 CVE-2015-5058 K17047 CVE-2015-5058: Performance improvement in packet processing.
477281-4 CVE-2014-6032 K15605 Improved XML Parsing
477278-5 CVE-2014-6032 K15605 XML Entity Injection vulnerabilities CVE-2014-6032 and CVE-2014-6033
476157-3 CVE-2014-4341 CVE-2014-4342 K15547 MIT Kerberos 5 vulnerability CVE-2014-4342
507842-2 CVE-2015-1349 K16356 Patch for BIND Vulnerability CVE-2015-1349
513382-13 CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0293 CVE-2015-0209 CVE-2015-0288 K16317 Resolution of multiple OpenSSL vulnerabilities
485917-3 CVE-2004-1060 K15792 BIG/IP is vulnerable to Path MTU discovery attack (CVE-2004-1060)
476738-1 CVE-2007-6199 K15549 rsync daemon may be configured to listen on a public port
430799-3 CVE-2010-5107 K14741 CVE-2010-5107 openssh vulnerability


Functional Change Fixes

ID Number Severity Solution Article(s) Description
500303-3 2-Critical K17302 Virtual Address status may not be reliably communicated with route daemon
499947 2-Critical   Improved performance loading thousands of Virtual Servers
497433-2 2-Critical   SSL Forward Proxy server side now supports all key exchange methods.
487552-3 2-Critical   triplets-not-allowed threshold too high because LTM minimum requirements for 6G guests are coming from 8G table
361367-3 2-Critical   Create 8 MB-aligned partitions/volumes for VE images to improve disk I/O.
523803 3-Major   Support two-factor authentication for Citrix Receivers in StoreFront proxy mode
512016-1 3-Major   DB variable added to determine DNS UDP truncation behavior.
504348-1 3-Major K53152418 iRules in event ADAPT_REQUEST_RESULT or ADAPT_RESPONSE_RESULT cannot see modified headers
502770-2 3-Major   clientside and serverside command crashes TMM
495273-1 3-Major   LDAP extended error info only available at debug log level which could affect Branch rules
480811-2 3-Major K25171635 qkview will not collect lib directories.
474465-3 3-Major   Analysis processes appear to use high CPU though not affecting data plane


TMOS Fixes

ID Number Severity Solution Article(s) Description
510393-1 1-Blocking   TMM may occasionally restart with a core file when deployed VCMP guests are stopped
504490-1 1-Blocking K16789 The BIG-IP system sometimes takes longer on boot up to become Active.
468175-8 1-Blocking   IPsec interop with Cisco systems intermittent outages
520349 2-Critical   iControl portal restarts
509475 2-Critical   SPDY profile with activation-mode always may not load on upgrade to 11.6.0 or later
509276-4 2-Critical   VXLAN tunnels with floating local addresses generate incorrect gratuitous ARPs on standby device
507487-1 2-Critical   ZebOS Route not withdrawn when VAddr/VIP down and no default pool
505323-1 2-Critical K17349 NSM hangs in a loop, utilizing 100% CPU
502675-1 2-Critical   Improve reliability of LOP/LBH firmware updates
501343-3 2-Critical   In FIPS HA setup, peer may use the FIPS public-handle instead of the FIPS private-handle
495335-1 2-Critical K17436 BWC related tmm core
492458-1 2-Critical   BIOS initial release
487233-1 2-Critical K16747 vCMP guests are unable to access NTP or RSYNC via their management network.
484733-4 2-Critical   aws-failover-tgactive.sh doesn't skip network forwarding virtuals
474751-1 2-Critical   IKEv1 daemon crashes when flushing SAs
474323 2-Critical   ePVA IPv6 feature is not available
467646 2-Critical K16184 IDE DMA timeouts can result in stuck processes
467196-5 2-Critical K16015 Log files limited to 24 hours
466266-1 2-Critical   In rare cases, an upgrade (or a restart) can result in an Active/Active state
460730-7 2-Critical   On systems with multiple blades, large queries can cause TMM to restart
452293-4 2-Critical K16186 Tunneled Health Monitor traffic fails on Standby device
445911-6 2-Critical   TMM fast forwarded flows are offloaded to ePVA
430323-4 2-Critical   VXLAN daemon may restart when 8000 VXLAN tunnels are configured
422460-8 2-Critical   TMM may restart on startup/config-load if it has too many objects to publish back during config load
376120-4 2-Critical K15726 tmrouted restart after reconfiguration of previously deleted route domain
519877 3-Major   External pluggable module interfaces not disabled correctly.
516073 3-Major   Revised AWS Setup Guide
514450-4 3-Major   VXLAN: Remote MAC address movement does not trigger ARL updates across TMMs.
512485-3 3-Major   Forwarding of flooded VXLAN-encapsulated unicast frames may introduce additional forwarding
510597-3 3-Major   SNAT Origin Address List is now stored correctly when first created
507461-6 3-Major   Net cos config may not persist on HA unit following staggered restart of both HA pairs.
507327-1 3-Major   Programs that read stats can leak memory on errors reading files
506281 3-Major   F5 Internal tool change to facilitate creating Engineering Hotfixes.
505878 3-Major K17355 Configuration load failure on secondary blades may occur when the chassis is rebooted
504572-4 3-Major K30038035 PVA accelerated 3WHS packets are sent in wrong hardware COS queue
503875-1 3-Major K81433151 Configure bwc policy category max rate
503604-3 3-Major   Tmm core when switching from interface tunnel to policy based tunnel
501953-2 3-Major   HA failsafe triggering on standby device does not clear next active for that device.
501371-4 3-Major K39672730 mcpd sometimes exits while doing a file sync operation
495862-1 3-Major   Virtual status becomes yellow and gets connection limit alert when all pool members forced down
494978-1 3-Major   The hostagentd daemon should not be running in non-vcmp mode.
494367-2 3-Major   HSB lockup after HiGig MAC reset
491791-3 3-Major   GET on non-existent pool members does not show error
490414-1 3-Major   /shared/vmisolinks present on systems running versions where block-devices are not present
489750-3 3-Major K16696 Deletion of FIPS keys by-handle may delete key in FIPS-card even if key exists in BIG-IP config
488916 3-Major   CIDR can now be used for SNAT Origin Address List
488374-2 3-Major K17019 Mismatched IPsec policy configuration causes racoon to core after failed IPsec tunnel negotiation
486512-7 3-Major   audit_forwarder sending invalid NAS IP Address attributes
485939-1 3-Major K16822 OSPF redistributing connected subnets that are configured in the network element with infinity metric in a HA pair.
485833-7 3-Major   The mcpd process may leak memory when using tmsh to modify user attributes
484861-5 3-Major K16919 A standby-standby state can be created when auto failback acts in a CRC disagreement scenario
483762-3 3-Major K15790 Overlapping vCMP guest MAC addresses
483751-1 3-Major K16729 Internal objects can have load failures on restarted blades
483699-1 3-Major K16888 No Access error when trying to access iFile object in Local Traffic :: iRules : iFile list
483683-3 3-Major K16210 MCP continues running after "Unexpected exception caught in MCPProcessor::rm_DBLowHighWide" error
482434 3-Major   Possible performance degradation in AWS cloud
481082-2 3-Major   Software auto update schedule settings can be reset during a full sync
478761-1 3-Major   load sys config default does not work with iCR
477859-1 3-Major   ZebOS config load may fail if password begins with numeric character
477789-4 3-Major   SSL Certificate can accommodate & (ampersand) in the Common Name, Organization Name, Division and SAN.
476288-1 3-Major   Tmrouted restarted after a series of creating/deleting route domains and adding/deleting protocols due to seg fault
473200-2 3-Major   Renaming a virtual server causes unexpected configuration load failure
473037-1 3-Major K16896 BIG-IP 2000/4000 platforms do not support RSS with L4 data on SCTP
472365-4 3-Major   The vCMP worker-lite system occasionally stops due to timeouts
471496-2 3-Major   Standby node sends a summary LSA for the default route into a stub area with the same metric value as that of Active node.
468517-5 3-Major K16249 Multi-blade systems can experience active/standby flapping after both units rebooted
464132-2 3-Major K15665 Serverside SSL cannot be disabled if Rewrite profile is attached
463715-3 3-Major   syscalld logs erroneous and benign timeout messages
447075-1 3-Major   CuSFP module plugged in during links-down state will cause remote link-up
440346-5 3-Major K16265 Monitors removed from a pool after sync operation
440154-3 3-Major   When IKEv2 is in use, user can only associate one Traffic Selector object with the IKE Peer object
439343 3-Major   Client certificate SSL authentication unable to bind to LDAP server
436682-5 3-Major   Optical SFP modules shows a higher optical power output for disabled switch ports
431634-6 3-Major   tmsh: modify gtm server 'xxx' virtual-servers replace-all-with 'yyy' fails
420204-3 3-Major   FIPS key deletion by-handle does not post an error if corresponding key object exists but the keyname is more than 32 characters long
416292-1 3-Major   MCPD can core as a result of another component shutting down prematurely
394236-3 3-Major   MCP unexpectedly exits, "failure has occurred, There is no active database transaction, status: 0 -
510049 4-Minor   Revised BIG-IP CGNAT Implementations content
493223-3 4-Minor   syscalld core dumps now keep more debugging information
490171-1 4-Minor K61258430 Cannot add FQDN node if management route is not configured
477111-5 4-Minor   Dual management routes in the main routing table
475592-2 4-Minor   Per-core and system CPU usage graphs do not match
473517-2 4-Minor   'OID not increasing error' during snmpwalk
463959-1 4-Minor   stpd attempts to connect to slots in a chassis that are empty
492422-4 5-Cosmetic K24508323 HTTP request logging reports incorrect response code
466116-3 5-Cosmetic   Intermittent 'AgentX' warning messages in syslog/ZebOS log files


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
511873 1-Blocking   TMM core observed during SSL cert-related tmsh execution.
507490-1 1-Blocking   Invalid HTTP/2 input can cause the TMM to hang
507139-1 1-Blocking   Invalid HTTP/2 input can cause the TMM to hang
504225-2 1-Blocking   Virtual creation with the multicast IPv6 address returns error message
488931-1 1-Blocking   TMM may restart when MPTCP traffic is being handled.
520413 2-Critical   Aberrant behavior with woodside TCP congestion control
516408-1 2-Critical   SSL reports certificate verification OK even verification returns failure for pcm=request.
516179-1 2-Critical K16420 Woodside falsely detects congestion
514521 2-Critical   Rare TMM Cores with TCP SACK and Early Retransmit
509310-5 2-Critical   Bad outer IPv4 UDP checksum observed on egressing VxLAN traffic on VIPRION chassis and 5000 series appliances
503620-3 2-Critical   ECDHE_ECDSA and DHE_DSS ciphers do not work with OpenSSL 1.0.1k and later
495875-2 2-Critical K16204 Connection limit on nodes causes TMM infinite loop and heartbeat failure with heavy traffic
495030-1 2-Critical   Segfault originating from flow_lookup_nexthop.
494319-1 2-Critical K16811 Proxy SSL caused tmm to core by dereferencing a null pointer
491030-6 2-Critical   Nitrox crypto accelerator can sometimes hang when encrypting SSL records
489796-2 2-Critical K16298 TMM cores when Woodside congestion control is used.
488908-1 2-Critical K16808 In client-ssl profile which serves as server side, BIG-IP SSL does not initialize in initialization function.
486450-2 2-Critical   iApp re-deployment causes mcpd on secondaries to restart
485189-3 2-Critical   TMM might crash if unable to find persistence cookie
480699-2 2-Critical K15728 HA mirroring can overflow buffer limits on larger platforms
480370-6 2-Critical K17147 Connections to virtual servers with port-preserve property will cause connections to leak in TMM
480299-1 2-Critical K16627 Delayed update of Virtual Address might not always happen.
480113-4 2-Critical   Install of FIPS exported key files (.exp) causes device-group sync failure
479171-3 2-Critical K15613 TMM might crash when DSACK is enabled
478983-1 2-Critical K16809 TMM core during certificate verification against CRL
478592-1 2-Critical K16798 When using the SSL forward proxy feature, clients might be presented with expired certificates.
477064-1 2-Critical K17268 TMM may crash in SSL
476683-2 2-Critical   Suspended DNS_RESPONSE events are not resumed
476599-4 2-Critical   TMM may panic when resuming DNS_REQUEST iRule event
475408-1 2-Critical   SSL persistence profile does not find the server certificate.
475231-5 2-Critical   TCP::close in CLIENTSSL_CLIENTCERT iRule event may result in tmm crash
474974-3 2-Critical   Fix ssl_profile nref counter problem.
474388-3 2-Critical K16957 TMM restart, SIGSEGV messages, and core
472585-3 2-Critical   tmrouted crashes after a series configuration changes
470191-2 2-Critical K15760 Virtual with FastL4 with loose initiation and close enabled might result in TMM core
417068-6 2-Critical   Key install or deletion failure on FIPS key names longer than 32 chars on some platforms
517124 3-Major   HTTP::retry incorrectly converts its input
516292-1 3-Major K17023 Incorrect handling of repeated headers
515482 3-Major K93258439 Multiple teardown conditions can cause crash
514604-1 3-Major K17467 Nexthop object can be freed while still referenced by another structure
513243-1 3-Major K17561 Improper processing of crypto error condition might cause memory issues.
512490-3 3-Major K16601 Increased latency during connection setup when using FastL4 profile and connection mirroring.
511517-1 3-Major K17111 Request Logging profile cannot be configured with HTTP transparent profile
511130-3 3-Major   TMM core due to invalid memory access while handling CMP acknowledgement
509416 3-Major   Suspended 'after' commands may result in unexpected behaviors
508716-4 3-Major   DNS cache resolver drops chunked TCP responses
507127-2 3-Major   DNS cache resolver is inserted to a wrong list on creation.
506702-4 3-Major   TSO can cause rare TMM crash.
506290-4 3-Major   MPI redirected traffic should be sent to HSB ring1
505964 3-Major   Invalid http cookie handling can lead to TMM core
505056-5 3-Major   BIG-IP system might send an egress packet with a priority different from that of ingress packet on the same flow.
504633-1 3-Major   DTLS should not update 'expected next sequence number' when the record is bad.
503741-2 3-Major K16662 DTLS session should not be closed when it receives a bad record.
503214-3 3-Major   Under heavy load, hardware crypto queues may become unavailable.
503118-2 3-Major   clientside and serverside command crashes TMM
502959-2 3-Major   Unable get response from virtual server after node flapping
502683-3 3-Major   Traffic intermittently dropped in syncookie mode, especially when hardware syncookie is on
502149-3 3-Major K06334742 Archiving EC cert/key fails with error 'EC keys are incompatible for Webserver/EM/iQuery.'
501690-3 3-Major   TMM crash in RESOLV::lookup for multi-RR TXT record
499950-5 3-Major   In case of intra_cluster ha, node flapping may still lead to inconsistent persistence entries across TMMs
499946-3 3-Major K16801 Nitrox might report bad records on highly fragmented SSL records
499478-2 3-Major K16850453 Bug 464651 introduced change-in-behavior for SSL server cert chains by not including the root certificate
499280-1 3-Major   Client side or server side SSL handshake may fail if it involves SHA512-signed certificates in TLS1.2
499150-3 3-Major K16721 OneConnect does not reuse existing connections in VIP targeting VIP configuration
498334-2 3-Major K16867 DNS express doesn't send zone notify response
498269-1 3-Major K16856 5200 does not forward STP BPDUs across VLAN groups when in PASSTHRU mode
497584-2 3-Major   The RA bit on DNS response may not be set
496950-1 3-Major   Flows may not be mirrored successfully when static routes and gateways are defined.
496588-1 3-Major   HTTP header that is larger than 64K can be analyzed incorrectly, leading to TMM crash
495574-3 3-Major K16111 DB monitor functionality might cause memory issues
495443-4 3-Major   ECDH negotiation failures logged as critical errors.
495253-1 3-Major K16603 TMM may core in low memory situations during SSL egress handling
494322-6 3-Major   The HTTP_REQUEST iRule event may cause the TMM to crash if the explicit proxy is used
493673-2 3-Major K12352524 DNS record data may have domain names compressed when using iRules
493140-1 3-Major K16969 Incorrect persistence entries are created when invoking cookie hash persistence within an iRule using offset and length parameters.
493117-6 3-Major K16986 Changing the netmask on an advertised virtual address causes it to stop being advertised until tmrouted is restarted
491518-2 3-Major   SSL persistence can prematurely terminate TCP connection
491454-6 3-Major   SSL negotiation may fail when SPDY profile is enabled
490817-1 3-Major   SSL filter might report codec alerts repeatedly
490480-3 3-Major   UCS load may fail if the UCS contains FIPS keys with names containing dot
490129-1 3-Major K16740 SMTP monitor could not create socket on IPv6 node address
488598-1 3-Major K16631 SMTP monitor on non-default route domain fails to create socket
487757 3-Major   Hybrid higig/front panel port packet discard (Ingress back-pressure v.s. Egress queue discard) counts can be expected during bursty or severe MMU traffic congestion on B4300/B2200/10000/12000-family platforms.
487592 3-Major K65442255 Change in the caching duration of OCSP response when there is an error
487587-2 3-Major   The allowed range of 'status-age' in OCSP Stapling Parameters (for clientSSL OCSP Stapling) might not be wide enough for some of the scenarios
487554-2 3-Major K41581381 System might reuse TCP source ports too quickly on the server side.
486724-3 3-Major K16750 After upgrading from v10 to v11 in a FIPS HA setup, config-sync fails
484305-2 3-Major K16733 Clientside or serverside command with parking command crashes TMM
483539-1 3-Major   With fastL4, incorrect MSS value might be used if SYN has options without MSS specified
483353-1 3-Major   HTTP compression might cause TMM crash in low-memory conditions
481880-5 3-Major   SASPD monitor cores
481216-1 3-Major   Fallback may be attempted incorrectly in an abort after an Early Server Response
480686-7 3-Major K15781 Packet loop in VLAN Group
480443-1 3-Major K17464 Internal misbehavior of the SPDY filter
479682-4 3-Major K16862 TMM generates hundreds of ICMP packets in response to a single packet
479176-1 3-Major K16824 TMM hangs and receives SIGABRT due to race condition during DNS db load
478840-1 3-Major K17014 Cannot delete keys in subfolders using the BIG-IP GUI
478734-5 3-Major   Incorrect 'FIPS import for failed for key' failure when operation actually succeeds
478195-4 3-Major   Installation of FIPS .exp key files sets incorrect public exponent.
477375-5 3-Major   SASP Monitor may core
475791-4 3-Major K16171 HTTP caching configured in a Web Acceleration profile may dispatch internal messages out-of-order, leading to assert
475322-2 3-Major   cur_conns number different in tmstat and snmp output.
474584-2 3-Major K16261 igbvf driver leaks xfrags when partial jumbo frame received
474226-2 3-Major   LB_FAILED may not be triggered if persistence member is down
474002-4 3-Major K15972 Server SSL profile unable to complete SSL handshake when server selects DHE-based key exchange, and is configured with 2048-bit or larger DH keys
473759-1 3-Major   Unrecognized DNS records can cause mcpd to core during a DNS cache query
472148-7 3-Major   Highly fragmented SSL records can result in bad record errors on Nitrox based systems
471821-1 3-Major   Compression.strategy "SIZE" is not working
471625-8 3-Major   After deleting external data-group, importing a new or editing existing external data-group does not propagate to TMM
470394-2 3-Major K16242 Priority groups may result in traffic being load balanced to a single pool member.
469705-4 3-Major   TMM might panic when processing SIP messages due to invalid route domain
469115-3 3-Major K75513721 Management client-ssl profile does not support multiple key/cert pair.
468472-7 3-Major   Unexpected ordering of internal events can lead to TMM core.
467868-3 3-Major K15959 Leak due to monitor status reporting
464651-2 3-Major K16636 Multiple root certificates with same 'subject' and 'issuer' may cause the tmm to core.
464163-3 3-Major K15988 Customized cert-key-chain of a client ssl profile might be reverted to its parent's.
457934-4 3-Major   SSL Persistence Profile Causing High CPU Usage
456763-5 3-Major   L4 forwarding and TSO can cause rare TMM outages
456413-5 3-Major   Persistence record marked expired though related connection is still active
455840-7 3-Major   EM analytic does not build SSL connection with discovered BIG-IP system
449891-7 3-Major   Fallback source persistence entry is not used when primary SSL persistence fails
447272-2 3-Major K17288 Chassis with MCPD audit logging enabled will sync updates to device group state
444710-6 3-Major   Out-of-order TCP packets may be dropped
443006-1 3-Major   In low memory situations initializing the HTTP parser will cause the TMM to crash
438792-5 3-Major   Node flapping may, in rare cases, lead to inconsistent persistence behavior
428163-3 3-Major   Removing a DNS cache from configuration can cause TMM crash
384451-6 3-Major   Duplicated cert/keys/chain might cause SIGABRTs and low-memory conditions
503560-2 4-Minor   Statistics profiles cannot be configured along with HTTP transparent profile on the same virtual server.
498597-5 4-Minor K16761 SSL profile fails to initialize and might cause SSL operation issues
481820-1 4-Minor   Internal misbehavior of the SPDY filter
480888-2 4-Minor K51148522 Tcl parks during HTTP::collect, and serverssl is present, data can be truncated
469739-4 4-Minor K16218 ConfigSync may fail if HA pair has dissimilar cert-key-chain sub-object names within an SSL profile
463696-5 4-Minor   FIPS keys might not be recoverable from UCS
451224-3 4-Minor   IP packets that are fragmented by TMM, the fragments will have their DF bit


Performance Fixes

ID Number Severity Solution Article(s) Description
476144-1 1-Blocking   TMM generates a core file when dynamically loading a shared library.
497619-6 3-Major K16183 TMM performance may be impacted when server node is flapping and persist is used
426939-5 3-Major K15337 APM Polices does not work in VIPRION 4800 chassis if there is no slot1


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
477240-2 2-Critical   iQuery connection resets every 24 hours
468519-1 3-Major   BIG-IP DNS configuration load failure from invalid bigip_gtm.conf file.
491554-2 4-Minor K54162409 [big3d] Possible memory leakage for auto-discovery error events.


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
488306-1 1-Blocking   Requests not logged locally on the device
478674-1 1-Blocking K08359230 ASM internal parameters for high availability timeout was not handled correctly
516523-2 2-Critical   Full ASM Config Sync was happening too often in a Full Sync Auto-Sync Device Group
515433-1 2-Critical K16639 BD crash on specific signature sets configuration.
512616-1 2-Critical   BD crash during brute force attack on cluster environement
508908-1 2-Critical   Enforcer crash
507919-1 2-Critical   Updating ASM through iControl REST does not affect CMI sync state
506372 2-Critical   XML validation files related errors on upgrade
504182-1 2-Critical   Enforcer cores after upgrade upon the first request
503169-1 2-Critical   XML validation files are broken after upgrade
493401-2 2-Critical   Concurrent REST calls on a single endpoint may fail
492978-1 2-Critical   All blades in a cluster remain offline after provisioning ASM or FPS
487420-1 2-Critical   BD crash upon stress on session tracking
486323-1 2-Critical K16817 The datasyncd process may keep restarting during the first 30 minutes following a hotfix installation
481476-5 2-Critical   MySQL performance
517245-2 3-Major   A request that should be blocked was forwarded to the server
515449-1 3-Major   bd agent listens on all addresses instead of the localhost only
515190-2 3-Major   Event Logs -> Brute Force Attacks can't show details after navigating to another page
514093-1 3-Major   Allow request logs to be filtered by destination IP
513763 3-Major   Slow response from GUI when listing Event Logs
512668-1 3-Major   ASM REST: Unable to Configure Clickjacking Protection via REST
512001-1 3-Major   Using REST API to Update ASM Attack Signatures Fails
512000-1 3-Major   Event Log Filter using Policy Group isn't accurate
511947-1 3-Major K24475274 Policy auto-merge of Policy Diff
511488-1 3-Major   Correlation restarting on a multi-bladed vCMP guest
511477-2 3-Major   Manage ASM security policies from BIG-IQ
510499-2 3-Major K17544 System Crashes after Sync in an ASM-only Device Group.
509968-3 3-Major   BD crash when a specific configuration change happens
509873-1 3-Major K01443011 Rare crash and core dump of TMM or bd after rebooting a device or joining a trust domain.
509495 3-Major   A TMM memory leak when HTTP protocol security enabled profile and no AFM license
508519-4 3-Major   Performance of Policy List screen
508338-1 3-Major   Under rare conditions cookies are enforced as base64 instead of clear text
507905 3-Major   Saving Policy History during UCS load causes DB deadlock/timeout
507902-1 3-Major K16697 Failure and restart of mcpd in secondary blade when cluster is part of a trust domain.
507289-3 3-Major   User interface performance of Web Application Security Editor users
506407 3-Major K04420402 Certain upgrade paths to 11.6.x lose the redirect URL configuration for Alternate Response Pages
506386-2 3-Major   Automatic ASM sync group remains stuck in init state when configured from tmsh
506355-1 3-Major   Importing an XML file without defined entity sections
506110-1 3-Major K25430927 Log flood within datasyncd.log in clustered environment
504973-1 3-Major   Configuring a route domain with 32 bit subnet mask, 128 bit mask saved instead
504718-2 3-Major K75221274 Policy auto-merge of Policy Diff
502852-2 3-Major   Deleting an in-use custom policy template
501612-4 3-Major   Spurious Configuration Synchronizations
500544-1 3-Major   XML validation files are not correctly imported/upgraded
498708-1 3-Major   Errors logged in bd.log coming from the ACY module
498189-3 3-Major   ASM Request log does not show log messages.
497769 3-Major   Policy Export: BIG-IP does not export redirect URL for "Login Response Page"
496565-1 3-Major   Secondary Blades Request a Sync
496264-1 3-Major   SOAP Methods Were Not Being Validated For WSDL Based XML Profiles
490284-3 3-Major K17383 ASM user interface extremely slow to respond (e.g. >2 minutes to render policy list)
489648-1 3-Major   Empty violation details for attack signatures
485764-5 3-Major K17401 WhiteHat vulnerability assessment tool is configured but integration does not work correctly
484079-1 3-Major K90502502 Change to signature list of manual Signature Sets does not take effect.
482915-1 3-Major K17510 Learning suggestion for the maximum headers check violation appears only for blocked requests
475819-4 3-Major K17325 BD crash when trying to report attack signatures
471103-1 3-Major K10340625 Ignoring null values for parameters with different content types


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
508544-1 3-Major   AVR injects CSPM JavaScript when the payload does not contain an HTML <head> tag
504414-1 3-Major   AVR HTTP External log - missing fields
503683 3-Major   Configuration upgrade failure due to change in an ASM predefined report name
503471-1 3-Major K17395 Memory leak can occur when there is a compressed response, and abnormal termination of the connection
500457-1 3-Major   Synchronization problem in AVR lookups that sometimes causes TMM and other daemons, such as the Enforcer, to crash
500034-1 3-Major   [SMTP Configuration] Encrypted password not shown in GUI
497681-1 3-Major   Tuning of Application DoS URL qualification criteria
497376-1 3-Major   Wrong use of custom XFF headers when there are multiple matches
488713-1 3-Major   Corrupt memory


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
497662-3 1-Blocking   BIG-IP DoS via buffer overflow in rrdstats
517146-1 2-Critical   Log ID 01490538 may be truncated
516075-6 2-Critical   Linux command line client fails with on-demand cert
513795-1 2-Critical   HTML5 client is not available on APM Full Webtop when using VMware Horizon 6.1
507782-1 2-Critical   TMM crashes for Citrix connection when Address field in the ICA file has non-patched/invalid data
506235-2 2-Critical   TMM Crash
497436-4 2-Critical   Mac Edge Client behaves erratically while establishing network access connection
496894-1 2-Critical   TMM may restart when accessing SAML resource under certain conditions.
495901-3 2-Critical   Tunnel Server crash if probed on loopback listener.
493360-1 2-Critical   Fixed possible issue causing Edge Client to crash during reconnect
489328-9 2-Critical   When BIG-IP virtual accessed with multiple tabs with long initial URLs before session creation can cause TMM crash.
473092-1 2-Critical   Transparent Proxy + On-Demand Cert Auth will reset
431980-1 2-Critical K17310 SWG Reports: Overview and Reports do not show correct data.
515387 3-Major   Update EPSEC package to latest verified in 11.6.0 branch
514636-1 3-Major K17137 SWG Category Lookup using Subject.CN results in a crash if the certificate presented does not have a Subject.CN.
514277-1 3-Major   Provide a way to enable connection bar for Citrix desktops only
513646-1 3-Major K37170914 APM(ACCESS)/SWG filter might process SessionDB replies after flow has been aborted resulting in orphaned timer
512999-1 3-Major K17432 LDAP Query may fail if user belongs to a group from foreign domain
512378-1 3-Major   Changing per request policy in the middle of data traffic can cause TMM to crash
511961-1 3-Major   BIG-IP Edge Client does not display logon page for FirePass
511648-2 3-Major K16959 On standby TMM can core when active system sends leasepool HA commands to standby device
511441-3 3-Major K17564 Memory leak on request Cookie header longer than 1024 bytes
509956-4 3-Major   Improved handling of cookie values inside SWG blocked page.
509758-2 3-Major   EdgeClient shows incorrect warning message about session expiration
509010 3-Major   Adding/Deleting a local user takes 30 seconds to complete
508719-1 3-Major K22391125 APM logon page missing title
508630-4 3-Major   The APM client does not clean up DNS search suffixes correctly in some cases
507899 3-Major   Custom APM report - Assigned IP field shows 'IPv4' instead of assigned IP value
507318-3 3-Major   JS error when sending message from DWA new message form using Chrome
507116-1 3-Major K17030 Web-application issues and/or unexpected exceptions.
506349-4 3-Major   BIG-IP Edge Client for Mac identified as browser by APM in some cases
505797-1 3-Major   Citrix Receiver for Android fails to authenticate with APM configured as StoreFront proxy and Access Gateway
505755-3 3-Major K11043155 Some scripts on dynamically loaded html page could be not executed.
504880-2 3-Major   TMM may crash when RDP client connects to APM configured as Remote Desktop Gateway
504606-3 3-Major   Session check interval now has minimum value
503319-4 3-Major K16901 After network access is established browser sometimes receives truncated proxy.pac file
502441-5 3-Major   Network Access connection might reset for large proxy.pac files.
502016-4 3-Major   MAC client components do not log version numbers in log file.
501498-1 3-Major   APM CTU doesn't pick up logs for Machine Certificate Service
499620-6 3-Major   BIG-IP Edge Client for MAC shows wrong SSL protocol version; does not display the protocol version that was negotiated.
499427-1 3-Major   Windows File Check does not work if the filename starts with an ampersand
498993-1 3-Major K16972 it is possible to get infinite loop in LDAP Query while resolving nested groups
498782-2 3-Major K17104 Config snapshots are deleted when failover happens
498469-5 3-Major   Mac Edge Client fails intermittently with machine certificate inspection
497455-1 3-Major   MAC Edge client crashed during routine Network Access.
497325-1 3-Major K16643 New users cannot log in to Windows-based systems after installing BIG-IP EDGE client in certain deployment
496817-1 3-Major   Big-IP Edge client for Windows fails to connect to Firepass server if tunnel is established through a proxy
495702-4 3-Major K40419383 Mac Edge Client cannot be downloaded sometimes from management UI
495319-3 3-Major   Connecting to FP with APM edge client is causing corporate network to be inaccessible
495265-1 3-Major   SAML IdP and SP configured in same access profile not supported
494176-5 3-Major   Network access to FP does not work on Yosemite using APM Mac Edge Client.
494088-4 3-Major   APD or APMD should not assert when it can do more by logging error message before exiting.
490844-4 3-Major K50522620 Some controls on a web page might stop working.
490681-1 3-Major K17470 Memcache entry for dynamic user leaks
490675-1 3-Major K16855 User name with leading or trailing spaces creates problems.
489382-7 3-Major   Machine Cert allows mismatched SubjectCN and FQDN for browsers in case of valid cert
487170-1 3-Major   Enahnced support for proxy servers that resolve to multiple IP addresses
486597-1 3-Major   Fixed Network Access renegotiation procedure
486268-1 3-Major   APM logon page missing title
485355-3 3-Major   Click-to-Run version of Office 2013 does not work inside PWS (Protected WorkSpace)
484582-2 3-Major   APM Portal Access is inaccessible.
483526-1 3-Major   Rarely seen Edge Client for Mac crash on session disconnect
482269-1 3-Major   APM support for Windows 10 out-of-the-box detection
480817-3 3-Major   Added options to troubleshoot client by disabling specific features
480242-5 3-Major   APD, APMD, MCPD communication error failure now reported with error code
477898-1 3-Major   Some strings on BIG-IP APM EDGE Client User Interface were not localized
477795-1 3-Major   SSL profile passphrase may be displayed in clear text on the Dashboard
476038-1 3-Major   Mac Edge Client crashes on OS X 10.7 if a user adds new server using its IP address rather than DNS name
475505-6 3-Major   Windows Phone 8.1 built-in browser is not properly detected by BIG-IP system.
474698-2 3-Major   BIG-IP as IdP can send incorrect 'Issuer' element for some SLO requests under certain conditions.
474582-3 3-Major   Add timestamps to logstatd logs for Policy Sync
473697-6 3-Major   HD Encryption check should provide an option to choose drive
473129-5 3-Major K15943 httpd_apm access_log remains empty after log rotation
471421-5 3-Major K16270 Ram cache evictions spikes with change of access policy leading to slow webtop rendering
471331-2 3-Major   APM::RBA reset due to a leaked HUDEVT_REQUEST_DONE
460715-5 3-Major   Changes in captive portal probe URL
452464-4 3-Major K28271912 iClient does not handle multiple messages in one payload.
452416-1 3-Major   tmctl leasepool_stat and snmp apmLeasepoolStatTable return incorrect values
437744-4 3-Major K15186 SAML SP service metadata exported from APM may fail to import.
437743-6 3-Major   Import of Access Profile config that contains ssl-cert is failing
436201-6 3-Major   JavaScript can misbehave in case of the 'X-UA-Compatible' META tag when a client uses IE11
433972-13 3-Major   New Event dialog widget is shifted to the left and Description field does not have action widget
433847-1 3-Major   APD crashes with a segmentation fault.
432900-9 3-Major   APM configurations can fail to load on newly-installed systems
431149-6 3-Major K17217 APM config snapshot disappears and users see "Access Policy configuration has changed on gateway"
416115-14 3-Major   Edge client continues to use old IP address even when server IP address changed
410089-2 3-Major   Linux client hangs after receiving the application data
403991-8 3-Major   Proxy.pac file larger than 32 KB is not supported
510596-6 4-Minor   Broken DNS resolution on Linux client when "DNS Default Domain Suffix" is empty
505662-1 4-Minor   Signed SAML IdP/SP exported metadata contains some elements in wrong order
504461-2 4-Minor   Logon Page agent gets empty user input in clientless mode 3 when a Variable Assign agent resides in front of it.
485202-1 4-Minor   LDAP agent does not escape '=' character in LDAP DN
482134-1 4-Minor   APD and APMD cores during shutdown.
471452-2 4-Minor   Access policy in progress with multiple tabs, landing URL set to the tab in which policy is completed.
465012-4 4-Minor   Rewrite plugin may crash if webtrace or debug log level is enabled for Portal Access
464992-7 4-Minor   Mac Edge fails to pass machine certificate inspection if domain component is included in search criteria
461597-11 4-Minor   MAC edge client doesn't follow HTTP 302 redirect if new site has untrusted self-signed certificate
460427-2 4-Minor   Address collision reported when the Primary blade goes down or its TMM crashes in an Chassis IntraCluster environment.
456911-3 4-Minor   Add BIG-IP hostname to system's static DNS host entries
493385-6 5-Cosmetic   BIG-IP Edge Client uses generic icon set even if F5 icon set is configured


WebAccelerator Fixes

ID Number Severity Solution Article(s) Description
514838-1 1-Blocking   TMM Crash on Relative URL
514785-2 1-Blocking   TMM crash when processing AAM-optimized video URLs
486346-3 2-Critical   Prevent wamd shutdown cores
447254-1 2-Critical   Core in parked transaction due to evicted stand-in document
511534-1 3-Major K44288136 A large number of regular expressions in match rules on path-segments may cause an AAM policy to take too long to load,
481431-1 3-Major   AAM concatenation set memory leak on configuration change
467633-5 3-Major   WAM CSS minification can add spaces to the output, potentially coring TMM (in rare cases)
488917-2 4-Minor   Potentially confusing wamd shutdown error messages


Service Provider Fixes

ID Number Severity Solution Article(s) Description
486356-1 2-Critical K16807 unable to configure a virtual with stats profile and sip profile in 11.6.0
482436-1 2-Critical K16973 BIG-IP processing of invalid SIP request may result in high CPU utilization
478442-5 2-Critical   Core in sip filter due to sending of HUDEVT message while processing of HUDCTL message
477318-1 2-Critical   Fixes possible segfault
466761-4 2-Critical   Heartbeat, UDP packet with only double CRLF, on existing SIP flow results in connection loss.
455006-7 2-Critical K50532341 Invalid data is merged with next valid SIP message causing SIP connection failures
512054-1 3-Major K17135 CGNAT SIP ALG - RTP connection not created after INVITE
511326-2 3-Major K24410405 SIP SUBSCRIBE message not forwarded by BIG-IP when configured as SIP ALG with translation.
507143-1 3-Major K17071 Diameter filter may process HUDCTL_ABORT message before processing previously queued events leading to tmm assertion
503676-4 3-Major   SIP REFER, INFO, and UPDATE request do not trigger SIP_REQUEST or SIP_REQUEST_SEND iRule events
500365-3 3-Major   TMM Core as SIP hudnode leaks
499701-1 3-Major   SIP Filter drops UDP flow when ingressq len limit is reached.
472376-3 3-Major K17190 A SIP virtual server may crash while trying to send a message if the connection is in the process of shutting down
448493-10 3-Major   SIP response from the server to the client get dropped


Advanced Firewall Manager Fixes

ID Number Severity Solution Article(s) Description
515562-1 2-Critical K16813 Sweep and flood may crash if it is enabled when AFM is not licensed or provisioned.
513403-1 2-Critical K16490 TMM asserts when certain ICMP packets (e.g multicast echo) are classified by AFM and match rules at Global and Route Domain context with logging enabled for these rules and also log-translations is enabled in AFM Logging configuration.
512609 2-Critical   Firewall rules specifying wildcard IPv6 addresses match IPv4 addresses
503541-2 2-Critical   Use 64 bit instead of 10 bit for Rate Tracker library hashing.
501480-3 2-Critical   AFM DoS Single Endpoint Sweep and Flood Vectors crash TMM under heavy traffic.
500925-3 2-Critical   Introduce a new sys db variable to control number of merges per second of Rate Tracker library.
517019-1 3-Major   AVR-HTTP (and Application DoS): Detection of pool-member is sometimes incorrect
515187-2 3-Major   Certain ICMP packets are evaluated twice against Global and Route Domain ACL rules.
513565-1 3-Major   AFM Kill-on-the-fly does not re-evaluate existing flows against any Virtual/SelfIP ACL policies if a Global or Route-Domain rule action is modified from Accept-Decisively to Accept.
511406-1 3-Major K16421 Pagination issue on firewall policy rules page
505624-1 3-Major   Remote logger will continue to get DoS L7 messages after it was removed from the virtual server configuration
503085-3 3-Major   Make the RateTracker threshold a constant
502414-2 3-Major   Make the RateTracker tier3 initialization number less variant.
501986-3 3-Major   Add a sys db tunable to make Sweep and Flood vectors be rate-limited per TMM process
496278-2 3-Major K16294 Disabling/enabling Rule within Rule List causes disabling/enabling of other Rule with the same name
500449 4-Minor   "Any IPv4 or IPv6" choice in sweep attack has atypical definition
497311 4-Minor   Can't add a ICMPv6 type and code to a FW rule.


Policy Enforcement Manager Fixes

ID Number Severity Solution Article(s) Description
519407-1 2-Critical   PEM session lookup by subscriber ID in TMSH fails if same IP is being used to create session with different subscriber ID
518967-1 2-Critical K45215234 Possible error when parsing for certain URL categorization input.
508051-1 2-Critical K53394418 DHCP response may return to wrong DHCP client.
506734 2-Critical   Cloud lookup stress condition
506283 2-Critical   100% TPS drop when webroot cloud lookup is enabled under stress condition
505529 2-Critical   wr_urldbd restarts continuously on VIPRION chassis with webroot lookup enabled.
505069 2-Critical   Webroot cloud lookup granularity
503381-2 2-Critical   SSL persistence may cause connection resets
500219-1 2-Critical   TMM core if identical radius starts messages received
496976-2 2-Critical   Crash when receiving RADIUS message to update PEM static subscriber.
484278-4 2-Critical K16734 BIG-IP crash when processing packet and running iRule at the same time
480544-1 2-Critical   Secondary IP flows are not forwarded in multiple IP session
473680-1 2-Critical K17559 Multiple DHCP solicit packets may not succeed.
515638 3-Major   5% drop in Webroot cloud lookup performance with mixed upper/lowercase URLs
512734 3-Major   Socket error when Webroot cloud lookup is enabled under stress condition
511064-1 3-Major K17108 Repeated install/uninstall of policy with usage monitoring stops after second time
510811-1 3-Major   PEM::info irule does not take effect if used right after PEM::session config policy irule
510721-1 3-Major   PEM::enable / PEM::disable iRule errors out with an error message
509105-1 3-Major K74503799 TMM cores sometimes if provisioning hold time is set to non-zero.
507753 3-Major   URL categorization missed if HTTP1.0 header does not have HOST
507549-1 3-Major   PEM may ignore a RAR if the target session is in the Provision-Pending state
506578 3-Major   Webroot cloud lookup does not yield a category.
505986 3-Major   Extra Webroot cloud lookup requests when cache is full
504028-1 3-Major   Generate CCR-T first and then CCR-I if session being replaced
495913-2 3-Major   TMM core with CCA-I policy received with uninstall
488166-1 3-Major   Provide an option to delete the session if IP class address Limit reached when new IP being added and create a new one instead.
467106-1 3-Major   Loading ucs file after install 11.6.0 on top of 11.5.0 failed when Gx reporting is enabled.
512663 4-Minor   Added urlcatblindquery iRule command
489767 4-Minor   Webroot cloud lookup support
478399-2 4-Minor   PEM subscriber sessions are created without PEM licensed, if "radiusLB-subscriber-awre" profile is configured.


Carrier-Grade NAT Fixes

ID Number Severity Solution Article(s) Description
519723 2-Critical   dnatutil utility needs update because DAG changed.
494280-3 2-Critical K16256 TMM crashes when PPTP finds a redirected flow when checking for an existing tunnel
493807-5 2-Critical K15989 TMM might crash when using PPTP with profile logging enabled
482202-1 3-Major   Very long FTP command may be ignored.


Fraud Protection Services Fixes

ID Number Severity Solution Article(s) Description
487553 3-Major   FPS alerts


Global Traffic Manager (DNS) Fixes

ID Number Severity Solution Article(s) Description
499719-1 3-Major   Order Zones statistics would cause database error
475549-3 3-Major   Input handling error in GTM GUI
475092 3-Major   Viewing DNS::Zones:Zones:Zones List:Statistics in the GUI generates error.
494305-3 4-Minor K36360597 [GUI] [GTM] Cannot remove the first listed dependent virtual server from dependency list.


Anomaly Detection Services Fixes

ID Number Severity Solution Article(s) Description
461949 2-Critical K16431 Virtual server with Portal Access and DOS profile resets connection


Traffic Classification Engine Fixes

ID Number Severity Solution Article(s) Description
513215 2-Critical   Only one of the TMMs load the classification library after an IM package upgrade
508660-1 2-Critical   Intermittent TMM crash in classification library
484483-2 2-Critical   TCP and UDP was classified as Unknown by classification library



Cumulative fixes from BIG-IP v11.6.0 Hotfix 4 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
503237-8 CVE-2015-0235 K16057 CVE-2015-0235 : glibc vulnerability known as Ghost
496849-1 CVE-2014-9326 K16090 F5 website update retrievals vulnerability
494078-4 CVE-2014-9326 K16090 Update Check feature can be target of man-in-middle-attack
492368-5 CVE-2014-8602 K15931 Unbound vulnerability CVE-2014-8602
492367-4 CVE-2014-8500 K15927 BIND vulnerability CVE-2014-8500
489323-1 CVE-2015-8098 K43552605 Out-of-bounds memory access when 'remotedesktop' profile is assigned to a virtual server.
485812-2 CVE-2014-3660 K15872 libxml2 vulnerability CVE-2014-3660
477274-8 CVE-2014-6031 K16196 Buffer Overflow in MCPQ
500088-1 CVE-2014-3571 K16123 OpenSSL Vulnerability (January 2015) - OpenSSL 1.0.1l update
497719-1 CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296, K15934 NTP vulnerability CVE-2014-9293, NTP vulnerability CVE-2014-9294, NTP vulnerability CVE-2014-9295, and NTP vulnerability CVE-2014-9296
496845-1 CVE-2014-9342 K15933 NTP vulnerability CVE-2014-9296
482710-4 CVE-2014-3566 K15702 SSLv3 protocol disabled in APM clients
474757-15 CVE-2014-3508 CVE-2014-5139 CVE-2014-3509 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 K15573 OpenSSL DTLS vulnerabilities CVE-2014-3505, CVE-2014-3506, and CVE-2014-3507, OpenSSL vulnerability CVE-2014-3508, OpenSSL vulnerability CVE-2014-3510, TLS vulnerability CVE-2014-3511.
471014-14 CVE-2014-2970 CVE-2014-5139 K15567 OpenSSL vulnerability CVE-2014-5139


Functional Change Fixes

ID Number Severity Solution Article(s) Description
480583-1 2-Critical   Support SIP/DNS DOS only for UDP packets and SIP DOS does not drop packets but count drops
477524 3-Major   Enable ssh for admin account and disable ssh for root account for Amazon deployments


TMOS Fixes

ID Number Severity Solution Article(s) Description
493275-3 1-Blocking   Restoring UCS file breaks auto-sync requiring forced sync.
483436-1 1-Blocking   Update 11.5.0 license files for "hourly billing" with production licenses.
482943-1 1-Blocking   Cannot upgrade because of lack of root/admin access.
476126-1 1-Blocking K16683 Adding SR-IOV and VLAN tagging in the F5 VE with Emulex NIC
475829-1 1-Blocking   AWS - VE is locked out after live install on 2nd slot.
499880 2-Critical   boot menu titles might not contain volume suffix
487567-4 2-Critical   Addition of a DoS Profile Along with a Required Profile May Fail
486137-3 2-Critical   License activation may not proceed if MCPD is not fully operational
484399-2 2-Critical K16048 Virtual Edition second installation slot and VMWare
478896 2-Critical   Hourly Billing AMIs for 11.6.0 contain internal instead of production license
477031-2 2-Critical   Deleting multiple VXLAN tunnels with flooding type multipoint can cause TMM restart
473641-1 2-Critical   Missing a tunnel FDB endpoint configuration in VXLAN tunnels could result in memory leak
497870-1 3-Major   PEM configured with BWC doing pem policy changes could trigger leak
497062-1 3-Major K16964 PEM configured with BWC doing PEM policy changes could trigger leak
492809-4 3-Major K16166 Small but continuous mcpd memory leak associated with statistics.
485352-1 3-Major   TMM dumps core file when loading configuration or starting up
483228-3 3-Major   The icrd_child process generates core when terminating
479359-1 3-Major   Loading a UCS file with no-platform-check stalls at platform check
479302-3 3-Major K16641 Error message in ltm log: bcm56xxd: reading L2 entry Operation failed bs_arl.cpp.
479152-5 3-Major K15888 Hardware parity error mitigation on 10000s/10200v/10250v platforms and B4300/B4340N and B2250 blades
474172 3-Major   BIG-IQ at times cannot discover BIG-IP running TMOS 11.6.0 - 11.6.0 HF3, failure reason: Failed getting time zone.
474166-4 3-Major   ConfigSync operation failing with rarely occurring sFlow error
473409-1 3-Major   Route domain stats can not be reset by using F5-BIGIP-LOCAL-MIB::ltmRouteDomainStatResetStats
468514-4 3-Major K16000 Receiving several ConfigSync requests in a short period of time may cause the mcpd process to restart and produce a core file
468021-3 3-Major   UCS file from earlier version may not load into 11.5.0 or later image
481135-1 4-Minor K15818 The pool members of a wide IP in Link Controller can not be modified once created
441512-4 4-Minor K15840 ConfigSync failing with sFlow error


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
490225-3 2-Critical K16030 Duplicate DNSSEC keys can cause failed upgrade.
484948-1 2-Critical K16732 UDP connflow may aborted from parked iRule in server_closed.
478812-2 2-Critical   DNSX Zone Transfer functionality preserved after power loss
502174-4 3-Major   DTLS fragments do not work for ClientHello message.
484429-4 3-Major   After updating a key/certificate in place and synchronizing the configuration, TMM may log critical-level messages that it could not load a key, certificate, or chain.
483974-2 3-Major   Unrecognized EDNS0 option may be considered malformed.
483328-4 3-Major K15851 Client SSL profiles might fail to complete handshake, system logs critical-level error '01260000:2: Profile name-of-profile: could not load key/certificate'
477924-1 3-Major   System can crash referencing compression provider where selection of provider has been deferred
477394-1 3-Major   LTM might reset and cause out-of-ports
476281 3-Major K16681 tmm crash on uninitialized variable
475055-3 3-Major   Core caused by incorrect accounting of I/O flows
472944-3 3-Major   SMTPS race condition after STARTTLS may cause incorrect SMTP responses
463902-3 3-Major   Hardware Compression in CaveCreek may cause excessive memory consumption.
437627-5 3-Major   TMM may crash if fastl4 vs has fragmeneted pkt
492780-1 4-Minor K37345003 Elliptic Curves Extension in ServerHello might cause failed SSL connection.


Application Security Manager Fixes

ID Number Severity Solution Article(s) Description
504232-1 2-Critical   Attack signatures are not blocked after signature/set change
489705-2 2-Critical K16245 Running out of memory while parsing large XML SOAP requests
478876-2 2-Critical   BIG-IP with many active ASM accounts after a restart
478672-1 2-Critical   Enforcer memory leak
477432-6 2-Critical   Roll forward from 11.3.0 with iApp configured fails to load correctly and causes bd to core
475856-1 2-Critical   BD may crash when enabling Base64 Decoding on Wildcard cookie
496011-1 3-Major K17385 Resets when session awareness enabled
492570-1 3-Major   JavaScript error during CSRF protection
481792-1 3-Major K84202340 BD may crash within HTTP payload parser.
476191-1 3-Major   Bypass unicode validation on XML and JSON profiles by internal parameter
476179-1 3-Major   Brute Force end attack operation mode reported as blocking while it was actually in transparent mode
475861-1 3-Major   Session Awareness: Requests are reset
475135-1 3-Major   BIG-IP goes offline after time change
474430-1 3-Major   Rare issue: client session might not be restored by fingerprint in the Web Scraping mitigation.
473410-1 3-Major   Policy Diff on merging missing URLs
470779-1 3-Major   The Enforcer should exclude session awareness violations when counting illegal requests.
469786-1 3-Major K04393808 Web Scraping Mitigation: Display of request status when configuration includes an ASM iRule
467776-1 3-Major   Fix in the Guardium to ASM protocol
450241-3 3-Major K21100172 iControl error when discover ASM from EM
441239-1 3-Major   Event Correlation is not enabled on vCMP guests if the disk is SSD.
438809-6 3-Major K17098 Brute Force Login


Application Visibility and Reporting Fixes

ID Number Severity Solution Article(s) Description
499299-1 2-Critical   Synchronization problem in AVR lookups sometimes causes TMM and other daemons, such as the Enforcer, to crash
480350-1 2-Critical K15251065 AVR and APM: TMM crashes
476336 2-Critical   TMM and other daemons, such as the Enforcer, crash
475439-1 2-Critical K16434 Synchronization problem in AVR lookups sometimes causes TMM and other daemons, such as the Enforcer, to crash
474251-1 2-Critical   IP addresses are not properly cleaned from lookup tables, so there might be no room for new IP addresses to be collected.
472969-1 2-Critical   If you try to create more than 264 AVR profiles, avrd might crash.
499036 3-Major   Rare cases of errors when loading data into mysql
496560-1 3-Major   AVR and APM: TMM crashes (additional fixes for ID 480350)
493825-1 3-Major K17520 Upgrade failure from version 11.4.0 due to incorrect configuration being saved
489682-1 3-Major K40339022 Configuration upgrade failure due to change in an ASM predefined report name
481541-1 3-Major   Memory leak in monpd when LTM and AVR or ASM are provisioned
478346-1 3-Major   Some AVR statistics not collected properly
472607 3-Major   VCMP: Warning messages in AVR log
467945-3 3-Major   Error messages in AVR monpd log


Access Policy Manager Fixes

ID Number Severity Solution Article(s) Description
488986-2 1-Blocking K16582 Access policy cannot enter Windows Protected Workspace on Internet Explorer versions 10 and 11, and edge client.
504060 2-Critical   iOS and Mac receivers cannot create account on Citrix StoreFront in proxy mode
494098-6 2-Critical K16857 PAC file download mechanism race condition
485906 2-Critical   TMM may core when an APM virtual server has a OneConnect profile attached to the virtual server
485465-3 2-Critical K16775 TMM might restart under certain conditions when executing SLO.
484454-3 2-Critical K16669 Users not able to log on after failover
482833 2-Critical   apd crash for missing db variable
479524-5 2-Critical K16823 If a "refresh" response header should not be rewritten, it can crash the rewrite plugin or be improperly rewritten
477540-1 2-Critical K16851 'ACCESS::policy evaluate' iRule command causes crash of apmd daemon
476736-2 2-Critical   APM IPv6 Network Access connection may fail in some cases
475049-1 2-Critical   Missing validation of disallowing empty DC configuration list
474532-5 2-Critical K16357 TMM may restart when SLO response is received on SLO request URL (.../post/sls)
474392-1 2-Critical   OS X 10.10 Yosemite support
474058-5 2-Critical K16689 When the BIG-IP system is configured as Service Provider, APD may restart under certain conditions
471874-1 2-Critical K16850 VDI plugin crashes when trying to respond to client after client has disconnected
469960-1 2-Critical K16333 Managing apd connection from tmm
458928-5 2-Critical   APMD cores in Kerberos authentication, when the agent tries to derefence a null authparam session variable.
455284-4 2-Critical K15907 Monitor traffic rejected with ICMP message, causing node down
496449-1 3-Major   APM does not support using session variables for the destination address in Citrix and VMware View remote desktop resources.
496447-1 3-Major   APM does not apply route domain configured in visual policy editor to Citrix/VMware View connections when their backends are specified as hostname/IP address.
496441-1 3-Major   APM does not apply route domain configured in visual policy editor to Java AppTunnel connections.
496440-1 3-Major   APM does not apply route domain configured in visual policy editor to Java RDP connections.
494284-3 3-Major K16624 Mac Edge Client, with primary language of German shows unneeded text shown under disconnected status.
494189-1 3-Major   Poor performance in clipboard channel when copying
493487-3 3-Major K45558362 Function::call() and Function::apply() wrapping does not work as expected
493164-3 3-Major K62553244 flash.net.NetConnection::connect() has an erroneous security check
492238-6 3-Major K16848 When logging out of Office 365 TMM may restart
492153-2 3-Major K17055 Edge clients shuts down the DTLS channel if the state of IP address on the adapter that was used to build the tunnel, changes to deprecated.
491887-1 3-Major K16645 Changing the ending of a macro in Access Policy crashes TMM.
491478-1 3-Major   EAM is a CMP plugin and spins up one thread per TMM.
491233-1 3-Major K16105 Rare deadlock in CustomDialer component
490811-5 3-Major   Proxy configuration might not to be restored correctly in some rare cases
490482-1 3-Major K16638 Applying Access Policy with an unused macro crashes TMM.
488892-3 3-Major   JavaRDP client disconnects
487859-1 3-Major K42022001 Importing local db users from a CSV file that has no UID set, displays incorrect information in the GUI.
485948-5 3-Major K17418 Machine Info Agent should have a fallback branch
485396 3-Major   Online help about persistent cookies does not specify supported use
484847-2 3-Major   DTLS cannot be disabled on Edge Client for troubleshooting purposes
484298-2 3-Major K16605 The aced process may restart in a loop
483601 3-Major K16895 APM sends a logout Bookmarked Access whitelist URL when session is expired.
483379-1 3-Major   High CPU consumption and unresponsive interface of the menubar icon after 20-30 minutes
482260-4 3-Major   Location of Captive portal configuration registry entry in 64 bit windows is incorrect
482046-1 3-Major   Old password is not verified during password change from View client.
481257-5 3-Major   Information on "OPSWAT Integration Libraries V3" is missing from CTU report
481210-1 3-Major K16426 Active Directory Query doesn't populate all values of multi-value attributes
481203-5 3-Major   User name case sensitivity issue
481046-5 3-Major K17497 F5_Inflate_text(o, incr, v) wrapper need to be fixed for case when o is script tag
481020-1 3-Major K17487 Traffic does not flow through VPN tunnel in environements where proxy server is load balanced
480995-1 3-Major   APM client components are not using extended logging by default.
480247-5 3-Major   Modifying edge client application folder causes gatekeeper to throw warning
480047-1 3-Major   BIG-IP Edge Client for Windows does not enable you to generate a client troubleshooting report from the user interface.
479451-1 3-Major K16737 Different Outlook users with same password and client IP are tied to a single APM session when using Basic auth
478491 3-Major   Microsoft RDP client for iOS doesn't work against F5 APM for versions >= 8.1.0
478333 3-Major   Edge-Client client shows an error about corrupted config file, when User's profile and temp folders located on different partitions
478285-2 3-Major   [MAC][NA] Routing table is not restored correctly in multi-homed environment if server settings disallow local subnet access
478214-1 3-Major   APM Native RDP Proxy does not allow users to authenticate without specifying a domain name.
478115-5 3-Major   The action attribute value of a form HTML tag is not properly rewritten in the Minimal Content Rewriting mode when it starts with "/"
477841-1 3-Major   Safari 8 does not use Network Access proxy.
477642-5 3-Major   Portal Access rewriting leads to page reload in Firefox
477474-3 3-Major K03431040 Wrong HTML rewriting at client side for very special case
477445-1 3-Major K16752 APM client improved to support 2 interface connected to the same network segment
476133-1 3-Major   In APM OAM authentication, ObSSOCookie _lastUseTime was not updated.
476033-1 3-Major   APM does not support Microsoft Remote Desktop 8.0.8 client for iOS to work using APM as RD Gateway.
476032-1 3-Major   BIG-IP Edge Client may hang for sometime when disconnecting from Firepass server
475770-1 3-Major   Fixed routing table management for cases when 2 or more interfaces are used
475682-6 3-Major   APM OAM should be sending a single Cookie header with the cookies delimited by semi-colon.
475650-5 3-Major K16271 The TMM may restart when processing single logout (SLO) messages.
475363-6 3-Major   Empty or invalid configuration, or during exception in NTLM, handling might not work as expected.
475360-6 3-Major   Edge client remembers specific virtual server URI after it is redirected
475262-1 3-Major   In some cases Edge Client for Windows does not re-resolve server hostname while reconnecting
475163-5 3-Major   Submitting an HTML form that does not have an action attribute is a 404 error and 'null' in the request URL.
475148-1 3-Major   Microsoft RDP Client for Mac OS X ver. 8.0.9 does not work correctly with BIG-IP APM.
475143 3-Major   CATEGORY::filetype command may cause tmm to crash and restart
474730-5 3-Major   Incorrect handling of form if it contains a tag with id=action
474231-5 3-Major   RAM cache evictions spikes with change of access policy which may lead to slow webtop rendering
473728-3 3-Major K16899 Incorrect HTML form handling.
473386-4 3-Major K17540 Improved Machine Certificate Checker matching criteria for FQDN case
473344-6 3-Major   Kerberos Request-Based Auth (RBA) failure when session is initially created on a different VIP.
472825-2 3-Major K52892802 The Dashboard charts may dip when a blade is rebooted.
471825-3 3-Major K16637 Add 'Date:' header in email message generated by APM Email agent to comply with RFC 5322.
471772-1 3-Major   APM does not support VMware View application remoting.
471714-1 3-Major K16637 Certain SMTP servers (Windows) do not receive complete email due to missing CRLF header terminator in Emails generated by APM Email agent.
471125 3-Major   Fixed issue causing EdgeClient to work improperly behind environment with CaptivePortal.
470414-4 3-Major   Portal Access rewrite daemon may crash while processing some Flash files
470225-4 3-Major K15951 Machine Certificate checker now correctly works in Internet Explorer 11
470205-2 3-Major   /config/.../policy_sync_d Directory Is 100% Full
469100-5 3-Major K17145 JavaScript index expressions with a comma are not properly rewritten
468478-5 3-Major K16659 APM Portal Access becomes unresponsive.
467849-6 3-Major   In some cases user cannot go to external sites through proxy when vpn is connected
466877-6 3-Major   When BIG-IP is used as SAML SP, signatures created by IBM Tivoli Federated Identity Manager may fail validation
466325-6 3-Major K16692 Continuous policy checks on windows might fail incorrectly in some cases
463776-2 3-Major K17142 VMware View client freezes when APM PCoIP is used and user authentication fails against VCS 5.3
463230-1 3-Major   Aced service does not recover if child process dies.
462727-1 3-Major K16436 TMM crash when processing ACCESS::session iRule without an attached Access Policy
456403-2 3-Major   Citrix Storefront native protocol
454493-1 3-Major K16566 VMWare View applications are not available on BIG-IP APM webtops
447013-4 3-Major K15890619 The Citrix Client Detection process may incorrectly prompt for the installation of client software.
441355-1 3-Major   Enable change password within vmview client when password doesn't meet the AD policy requirements
439518-3 3-Major K16254 Portal access resource item modifications are not synced
438730-5 3-Major K16666 DNS Filtering driver causes crash/BSOD
432102-6 3-Major   HTML reserved characters not supported as part of SAML RelayState
431810-5 3-Major K16315 APMD process core due to missing exception handling in execute agents
428387-2 3-Major   SAML SSO could fail if SAML configuration contains special XML characters (&,<,>,",')
418850-1 3-Major   Do not restrict AD to be the last auth agent for View Client
407350-4 3-Major   Client side checks on Windows Phone 8
400726-4 3-Major   No support for multi-valued attributes inside SAML assertion.
398657-8 3-Major   Active Session Count graph underflow
503924-1 4-Minor   Citrix receivers cannot authenticate
492844-1 4-Minor   Office365 generated SAML SLO message causes browser connection to be reset.
489888-1 4-Minor   Configuring VDI profile when APM is not provisioned, but does not.
489364-1 4-Minor   Now web VPN client correctly minimizes IE window to tray
485760-1 4-Minor   Tag <NameIDFormat> in SAML metadata may contain wrong attributes
480827-1 4-Minor   Logging might show unnecessary messages when Citrix Receiver connects to Storefront: err tmm[20105]: 01490563:3: 00000000: Access stats encountered error: Failed to add/delete session entry (ERR_NOT_FOUND).
480360-5 4-Minor   Edge Client for Mac blocks textexpander application's functionality
478397-1 4-Minor   Memory leak in BIG-IP APM Edge Client Windows API.
477138-1 4-Minor   Only one of several VMware View Desktop/Application pools with the same display name can be launched from APM Webtop
473377-5 4-Minor   BIG-IP as IdP may rejects AuthnRequest with specific NameID format
472216-2 4-Minor   Duration counter for customized Edge Client
466797-6 4-Minor   Added warning message when maximum session timeout is reached
464547-1 4-Minor   Show proper error message when VMware View client sends invalid credentials to APM
450033-5 4-Minor   Sometimes VMware View client 2.3 for Windows can't launch desktops via APM
447302-3 4-Minor   APM incorrectly supports 'redirect' ending in an access policy for web browser clients when deployed for Citrix Web Interface in proxy mode.
432423-5 4-Minor   Need proactive alerts for APM license usage
421901-2 4-Minor   The 'Restore down' button can be hidden for full-screen RDP resources.
503673-1 5-Cosmetic   APM sets MRHSession cookie on /cgi/login request from Citrix Receivers
486344-2 5-Cosmetic   French translation does not properly fit buttons in BIG-IP Edge client on Windows
484856-1 5-Cosmetic   Citrix remote desktop visible even if the user cannot access it


Wan Optimization Manager Fixes

ID Number Severity Solution Article(s) Description
479889-5 1-Blocking   Memory leaks when iSession and iControl are configured
480305-1 4-Minor   tmm log flood: isession_handle_evt: bad transition:7


Service Provider Fixes

ID Number Severity Solution Article(s) Description
476886-3 3-Major K15727 When ICAP cuts off request payload, OneConnect does not drop the connection
472092-3 3-Major   ICAP loses payload at start of request in response to long execution time of iRule


Advanced Firewall Manager Fixes

ID Number Severity Solution Article(s) Description
496036 1-Blocking K16640 GUI throws an error in some situations when an ASM policy is assigned to virtual server
484245-1 1-Blocking   Delete firewall rule in GUI changes port settings in other rules to 'any'
498227-2 2-Critical   Incorrect AFM firewall rule counter update after pktclass-daemon restarts.
497342 2-Critical   TMM crash while executing FLOW_INIT event (with multiple commands that abort the connection) in an iRule attached to an AFM firewall rule.
480903-1 2-Critical   AFM DoS ICMP sweep mitigation performance impact
478644 2-Critical   dwbld race with mcpd causes core.
477769-1 2-Critical   TMM crash (panic) in AFM pktclass code (Assertion 'classifier ref non-zero' failed.) when virtual server has SPDY or HTTP Prefetching enabled along with AFM Rules.
469512-2 2-Critical   TMM aborted by SOD due to heartbeat failure when trying to load huge firewall policies.
500640-1 3-Major   TMM core could be seen if FLOW_INIT iRule attached to Virtual server
497732-2 3-Major   Enabling specific logging may trigger other unrelated events to be logged.
497667-2 3-Major   Configuring of ICMPv4/ICMPv6 ip-protocol in mgmt port ACL Rules generated error
497263-1 3-Major   Global whitelist count exhausted prematurely
496498-3 3-Major   Firewall rule compilation will fail in certain scenario when there are multiple scheduled AFM rules and one of the non scheduled AFM rule is modified.
495928-5 3-Major   APM RDP connection gets dropped on AFM firewall policy change
495698-3 3-Major   iRule can be deleted even though it exists in a rule-list
493234-1 3-Major   Device version in AFM log message could be empty
485787-1 3-Major   Firewall ACL counters for staged policy attached to a Virtual/SelfIP are not incremented when a policy with a similar rule to drop/reject packets is enforced by the Global or Route Domain context
485771-1 3-Major   TMM crashes while executing multiple FLOW_INIT events and one of the event triggers an abort.
480826 3-Major   IPs can be added for infinite duration
478816 3-Major   Fastl4 TCP connection trasitions are not logged
477576-1 3-Major   Valid iRule command FLOWTABLE::limit gets rejected when virtual server or route domain name is not specified
474896-1 3-Major K10035412 Remote logs without attack ID and mitigation fields
442535-5 3-Major K16227 Time zone changes do not apply to log timestamps without tmm restart
429885-6 3-Major K17576 Traffic that does not match any virtual or Self IP is dropped silently (without any logs or statistics)
498785 4-Minor   Black List Classes/Black List Categories terminology inconsistency
481189-2 4-Minor   Change the default value of pccd.hash.load.factor to 25
480623 4-Minor   Category defaulted to whitelist when a valid category was not specified
480196 4-Minor   Packets not counted in tmctl ip_intelligence_stat on accept-decisively ACL match
478631 4-Minor   No validation for Shun TTL lengths


Policy Enforcement Manager Fixes

ID Number Severity Solution Article(s) Description
489754-1 2-Critical K17408 Flow based reporting attribute mismatch between TMUI and TCL
483798-1 2-Critical   TMM crashes if iRule PSC::ip_address is used after RADIUS Authentication of DHCP discovery.
481373-1 2-Critical   TMM might core when deleting an entry for a user in a Radius AAA cache
472860-3 2-Critical   RADIUS session statistics for the subscribers created with an iRule running on the RADIUS virtual server are not incremented.
484095-1 3-Major   RADIUS accounting message with multiple IPv6 prefix causes TMM crash
482137-1 3-Major   Adding TCP iRules to PEM space
479917-1 3-Major   TMM crashes if new IP address is added to a session through radius interim update message.
476705-1 3-Major   TMM can crash if receiving radius start or stop messages with multiple IP but no subscriber ID.
474638-1 3-Major   PEM: Session policy list may be lost if there is an radius update of custom attributes
453959-3 3-Major   UDP profile improvement for flexible TTL handling
481950-1 4-Minor   DHCP: Need an upgrade script for DHCPRELAY virtuals for BIG-IP version 11.5 and 11.4
476904-2 4-Minor   App type 0 session Update Failed on PEMDB: ERR_INPROGRESS


Fraud Protection Services Fixes

ID Number Severity Solution Article(s) Description
484020 2-Critical   If Identify as Username is enabled for a parameter, the Encrypt checkbox is not grayed out.
492549 3-Major   FPS injection only into success responses
489933 3-Major   Generic malware false positives
486001 3-Major   Application Layer encryption not working on password field in certain situations
485253 3-Major   Enable directory protection
482034 3-Major   Browser displays error in console in Firefox 3.6.22
474469 3-Major   Identical source integrity alerts are present.
473771 3-Major   No URL path in the Browser Automation alert
491168 4-Minor   Encrypt checkbox should be greyed out for a new parameter when Application Layer Encryption is disabled under URL Configuration.
478859 4-Minor   Username displayed with trailing "&" sign


Global Traffic Manager (DNS) Fixes

ID Number Severity Solution Article(s) Description
482442-5 4-Minor   [GTM] [GUI] Changes to a single wideip Propagates to All WIPs


Traffic Classification Engine Fixes

ID Number Severity Solution Article(s) Description
487512-1 2-Critical   Enable Bittorrent classification in Qosmos by default
479450 2-Critical K16766 SSL traffic is not forwarded to destination



Cumulative fixes from BIG-IP v11.6.0 Hotfix 3 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
484635-1 CVE-2014-3513 CVE-2014-3567 CVE-2014-3566 CVE-2014-3568 K15722 OpenSSL DTLS SRTP Memory Leak CVE-2014-3513, OpenSSL vulnerability CVE-2014-3567, and OpenSSL vulnerability CVE-2014-3568.
451218-2 CVE-2014-8730 K15882 TLS1.x padding vulnerability CVE-2014-8730.


Functional Change Fixes

None


TMOS Fixes

ID Number Severity Solution Article(s) Description
478791-1 1-Blocking   Hardware compression test fails on 5000 series, 7000 series, 10000 series platforms


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
488208-1 2-Critical   openssl v1.0.1j.
485188-1 3-Major   Support for TLS_FALLBACK_SCSV


Global Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
487808-3 3-Major   End of Life announcement for inbound and outbound cost-based link load balancing and inbound link path-based load balancing.



Cumulative fixes from BIG-IP v11.6.0 Hotfix 2 that are included in this release


Functional Change Fixes

None


TMOS Fixes

ID Number Severity Solution Article(s) Description
476475 1-Blocking   SSL accelerator card does not function on the BIG-IP 12250 platform.
479374-5 2-Critical K16255 Setting appropriate TX driver settings for 40 GB interfaces.
478948 2-Critical   DC PSU reported as AC
477676 2-Critical   HSB v2.3.12.1 bitstream integrated to fix HSB firmware issues
473772 3-Major   SNMP reports the incorrect product name for the BIG-IP 10350 NEBS platform.
473210 3-Major   Chassis Temperature Status not showing Nitrox3x3 temperatures
472767-1 3-Major   Adding slots to running guests with host-iso can become stuck
467693-1 3-Major K16664 sysObjectID SNMP OID returns 'linux' instead of BIG-IP platform.
410101-3 3-Major   HSBe2 falls off the PCI bus


Local Traffic Manager Fixes

ID Number Severity Solution Article(s) Description
477571-1 2-Critical   HTTP/2 support.



Cumulative fixes from BIG-IP v11.6.0 Hotfix 1 that are included in this release


Vulnerability Fixes

ID Number CVE Solution Article(s) Description
480931-1 CVE-2014-6271 CVE-2014-7169 CVE-2014-7187 CVE-2014-7186 CVE-2014-6277 CVE-2014-6278 K15629 Multiple BASH vulnerabilities - ShellShock


Functional Change Fixes

None


Cumulative fix details for BIG-IP v11.6.2 that are included in this release

684879-3 : Malformed TLS1.2 records may result in TMM segmentation fault.

Component: Local Traffic Manager

Symptoms:
TMM receives a malformed TLS1.2 record.

Impact:
TMM produces a core file and takes the configured HA failover action.

Workaround:
No workaround.


679235-4 : Inspection Host NPAPI Plugin for Safari can not be installed

Component: Access Policy Manager

Symptoms:
Inspection Host NPAPI Plugin for Safari on macOS High Sierra can not be installed.

Conditions:
macOS High Sierra, Inspection Host Plugin package installation triggered.

Impact:
Inspection Host plugin cannot be installed, therefore, endpoint checks will not work.

Workaround:
There is no workaround at this time.

Fix:
Inspection Host NPAPI Plugin for Safari can now be installed successfully.


676300-6 : EPSEC binaries may fail to upgrade in some cases

Solution Article: K04551025

Component: Access Policy Manager

Symptoms:
Windows client may fail to upgrade endpoint security package in some cases. This happens due to a corrupted registration of old endpoint security components.

Conditions:
Corrupted registry entry related to endpoint security components.

Impact:
Client may not be able to upgrade to latest endpoint package hosted on APM.

Workaround:
Remove the following registry keys from the registry:

Note: Use extra care editing the registry. Only remove the following keys, and no others.


"HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_CLASSES_ROOT\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_CLASSES_ROOT\Wow6432Node\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_CLASSES_ROOT\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"
"HKEY_CLASSES_ROOT\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"


"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"


"HKCU\SOFTWARE\Classes\Wow6432Node\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKCU\SOFTWARE\Classes\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKCU\SOFTWARE\Classes\Wow6432Node\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKCU\SOFTWARE\Classes\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKCU\SOFTWARE\Classes\Wow6432Node\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"
"HKCU\SOFTWARE\Classes\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"

Fix:
EPSEC binaries now upgrade successfully.


667278-4 : DSC connections between BIG-IP units may fail to establish

Component: TMOS

Symptoms:
The device service clustering (DSC) connection between two BIG-IP units may fail to establish. One unit will log messages similar to the following example:

-- err mcpd[7912]: 01071af4:3: Inbound CMI connection from IP (192.168.100.1) denied because it came from VLAN (v1542), not from expected VLAN (tmm).

While the unit at the other end of the connection will log messages similar to the following example:

-- notice mcpd[5730]: 01071432:5: CMI peer connection established to 192.168.200.1 port 6699 after 0 retries
May 31 20:58:04 BIG-IP-c-sea notice mcpd[5730]: 0107143c:5: Connection to CMI peer 192.168.200.1 has been removed

Conditions:
This issue occurs when the Self-IP addresses used for Config-Sync by the two BIG-IP units are not in the same IP subnet, and special routing is configured between the BIG-IP units. Examples of special routing include a gateway pool or dynamic routing configurations with multiple routes to the same destination (i.e., ECMP routing).

Impact:
Config-Sync and device discovery operations will fail between affected units.

Workaround:
You can work around this issue by using Self-IP addresses for Config-Sync that are on the same IP subnet or rely on simpler routing to achieve connectivity (i.e., a single route).

Fix:
Config-Sync and device discovery operations no longer fail.


665905-1 : Signature System corruption from specific ASU prevents ASU load after upgrade

Solution Article: K83305000

Component: Application Security Manager

Symptoms:
After loading Attack Signature Update "ASM-SignatureFile_20170403_145743.im" on 11.5.4 HF2 (or later) and upgrading to certain software versions, attempts to perform Signature Update fail.

Conditions:
-- Loading Attack Signature Update "ASM-SignatureFile_20170403_145743.im".
-- Using v11.5.4 HF2 (or later).
-- Upgrading the device to 11.6.1, 12.1.0, 12.1.1, or 12.1.2.

Impact:
Attempts to perform Signature Update fail.

Workaround:
The mistaken Signature System can be deleted using the following SQL:

----------------------------------------------------------------------
UPDATE PLC.NEGSIG_SIGNATURE_SYSTEMS set system_id = 14 where system_id = (select system_id FROM PLC.NEGSIG_SYSTEMS where system_name = 'Apache');
DELETE FROM PLC.NEGSIG_SYSTEMS where system_name = 'Apache';
----------------------------------------------------------------------

Fix:
Database corruption introduced by loading Attack Signature Update 'ASM-SignatureFile_20170403_145743.im' is now corrected upon upgrade.


664930-1 : Policy automatic learning mode changes to manual after failover

Component: Application Security Manager

Symptoms:
Policy automatic learning mode changes to manual when a failover occurs.

Conditions:
-- ASM provisioned.
-- Device group with ASM policy sync configured for multi-blade devices.
-- ASM Policy is in automatic learning mode.
-- A failover occurs.

Impact:
The policy changes from automatic learning mode to manual.

Workaround:
None.

Fix:
Policy automatic learning mode no longer changes to manual when a failover occurs. Automatic learning mode will now be disabled only in active/active configurations.


663326-3 : Thales HSM: "fipskey.nethsm --export" fails to make stub keys

Component: Local Traffic Manager

Symptoms:
When using "fipskey.nethsm --export -i /shared/tmp/testkey.pem -o thaleskey" to export a key file from BIG-IP and import into HSM, the HSM fails to generate the stub key at /config/ssl/ssl.key/ on the BIG-IP system.

Conditions:
-- Thales HSM is installed.
-- Running 'fipskey.nethsm --export' to export a key file from BIG-IP and import it to the Thales HSM.

Impact:
Even the key has been stored in HSM, the BIG-IP is still unable to use it because of its lacking stub key to be configured on the BIG-IP system.

Workaround:
This can be worked around by directly using the Thales command, for example:

[root@localhost:Active:Standalone] config # generatekey --import pkcs11 certreq=yes
type: Key type? (DES3, RSA, DES2) [RSA] >
pemreadfile: PEM file containing RSA key? []
> /shared/tmp/testkey.pem
embedsavefile: Filename to write key to? []
> /config/ssl/ssl.key/thales2
plainname: Key name? [] > thales2
x509country: Country code? [] > US
x509province: State or province? [] > WA
x509locality: City or locality? [] >
x509org: Organisation? [] > F5
x509orgunit: Organisation unit? [] > AS
x509dnscommon: Domain name? [] >
x509email: Email address? [] > test@test.com
nvram: Blob in NVRAM (needs ACS)? (yes/no) [no] >
digest: Digest to sign cert req with? (md5, sha1, sha256, sha384, sha512)
  [default sha1] >

Fix:
When using 'fipskey.nethsm --export -i /shared/tmp/testkey.pem -o thaleskey' to export a key file from BIG-IP and import into HSM, the HSM now generates a stub key and stores it at /config/ssl/ssl.key/ on the BIG-IP system, as expected.


658852-1 : Empty User-Agent in iSessions requests from APM client on Windows

Component: Access Policy Manager

Symptoms:
'User-Agent' might be empty in some '/isession' requests from APM client on Microsoft Windows. Having empty User-Agent headers is not in RFC compliance and forces some firewall to block the connection. This might result in failure to establish a VPN tunnel.

Conditions:
'/isession' requests from APM client on Windows.

Impact:
Failure to establish a VPN tunnel.

Workaround:
None.

Fix:
All connections from APM client now contain 'User-Agent:' strings, as expected.


655691-1 : GUI image list contains misleading 'MD5 Sum Verified' field

Component: TMOS

Symptoms:
In the GUI, images in the Image List and Hotfix List contain a field called 'MD5 Sum Verified', which is misleading since no such verification is actually done.

Conditions:
Using BIG-IP GUI and viewing the Image List and Hotfix List.

Impact:
It appears that MD5 sums are being verified when in reality much more limited tests are done.

Workaround:
N/A

Fix:
Replace 'MD5 Sum Verified' with 'BIG-IP Image Verified' in Image List and Hotfix List in BIG-IP GUI to more accurately reflect our verification procedures.


655059-2 : TMM Crash

Component: TMOS

Symptoms:
Undisclosed conditions may cause TMM to crash

Conditions:
Undisclosed

Impact:
TMM crash, leading to HA failover

Fix:
Improve TMM reliability


655021-3 : BIND vulnerability CVE-2017-3138

Solution Article: K23598445


654566-1 : Incomplete files still linked in /shared/vmisolinks

Solution Article: K94822416

Component: TMOS

Symptoms:
If copying of an image file is interrupted and leaves a partial file with a .part or .filepart extension, it is still linked in /shared/vmisolinks and synced between blades.

Conditions:
Copy of an image to /shared/images is interrupted and a file with a .part or .filepart extension is left behind.

Impact:
The corrupted copy might appear valid when it is not.

Workaround:
Delete incomplete file copies with extension .part or .filepart.

Fix:
Csyncd ignores files with extensions .part or .filepart in /shared/images.


654109-3 : Configuration loading may fail when iRules calling procs in other iRules are deleted

Solution Article: K01102467

Component: Local Traffic Manager

Symptoms:
Loading of the configuration fail with a message indicating a previously deleted iRule cannot be found:

 01020036:3: The requested rule (/Common/rule_uses_procs) was not found.

Conditions:
- iRule A is calling another iRule B using proc calls
- iRule A is attached to a virtual server.
- Detaching and deleting iRule A.
- Loading the config (or performing config sync).

Impact:
iRules are still referenced after implicit deletion (via load).
Configuration does not load.

Workaround:
Force reloading of the MCP binary database.

For specific steps, see K13030: Forcing the mcpd process to reload the BIG-IP configuration (https://support.f5.com/csp/article/K13030).

Fix:
Configuration loading no longer fails when iRules calling procs in other iRules are deleted.


653993-2 : A specific sequence of packets to the HA listener may cause tmm to produce a core file

Component: Local Traffic Manager

Symptoms:
A specific sequence of packets to the HA listener may cause tmm to produce a core file.

Conditions:
The BIG-IP is configured for HA.

Impact:
The TMM process may restart and produce a core file.


653880-1 : Kernel Vulnerability: CVE-2017-6214

Solution Article: K81211720


652516-1 : Multiple Linux Kernel Vulnerabilities

Solution Article: K31603170


652400-1 : During blade changes, PBA may cause a TMM restart

Component: Carrier-Grade NAT

Symptoms:
TMM will restart, and an ASSERT will appear in the logs that there have been too many retries.

Conditions:
-- A port block allocation configuration with very high CPU utilization.
-- The addition of a new blade.
-- Running a version earlier than 12.0.0.

Impact:
TMM will restart, so existing blocks and connections will be lost. Traffic disrupted while tmm restarts.

Workaround:
There is no workaround.


650002-3 : tzdata bug fix and enhancement update

Component: TMOS

Symptoms:
There have been changes to timezone data that impact tzdata packages:

* Mongolia no longer observes Daylight Saving Time (DST).

* The Magallanes Region of Chile has moved from a UTC-04/-03 scheme to UTC-03 all year. Starting 2017-05-13 at 23:00, the clocks for the Magallanes Region will differ from America/Santiago.

Conditions:
-- Mongolia during DST portion of the year.
-- Comparing clock times in the America/Santiago zone with those in the Magallanes Region.

Impact:
Timezone data provided in tzdata will not match the area's time. Clocks for the Magallanes Region will differ from America/Santiago (its current timezone).

Workaround:
None.

Fix:
To accommodate for Mongolia no longer observing DST, the new America/Punta_Arenas zone was created. Changes were also made to support other timezone changes.

* The zone1970.tab file has been added to the list of files to be installed with the tzdata packages installation.

Note: Users of tzdata are advised to upgrade tzdata to zdata-2017b-1.el6


649933-3 : Fragmented RADIUS messages may be dropped

Component: Service Provider

Symptoms:
Large RADIUS messages may be dropped when processed by iRules.

Conditions:
This occurs when a RADIUS message that exceeds 2048 bytes is processed by an iRule containing the RADIUS::avp command.

Impact:
The RADIUS message will be dropped, and an error will be logged that resembles:

Illegal argument (line 1) (line 1) invoked from within "RADIUS::avp 61 "integer""

Workaround:
Remove RADIUS::avp commands from iRules processing large messages, or ensure that no RADIUS client or server will send large messages.


649907-3 : BIND vulnerability CVE-2017-3137

Solution Article: K30164784


649904-3 : BIND vulnerability CVE-2017-3136

Solution Article: K23598445


649613-1 : Multiple UDP/TCP packets packed into one DTLS Record

Component: Access Policy Manager

Symptoms:
The system converts the server provided packet into PPP buffers. These PPP packets are used to pack into DTLS records. Currently there is a limit of about 14 KB of DTLS records, such that the system can pack multiple PPP records into one DTLS record.

However, creating bigger DTLS record can cause server IP Fragmentation. In the lossy environment, losing one IP fragment can cause the complete DTLS record to be lost, resulting in poor performance.

Conditions:
Multiple UDP/TCP packets packed into one DTLS Record.

Impact:
In networks with packet losses, the APM end-user application might suffer poor network performance.

Workaround:
None.

Fix:
The system packs one PPP record into one DTLS record, which reduces / eliminates IP Fragmentation and prevents poor performance.


648954-3 : Configuration validation (e.g., ConfigSync) may fail after an iRule is deleted, if the iRule made procedure calls

Solution Article: K01102467

Component: Local Traffic Manager

Symptoms:
Configuration validation fails spuriously, including potentially as a result of a ConfigSync or modifying an iRule, with an error similar to the following:

    01020036:3: The requested rule (/Common/rule_uses_procs) was not found.

Referencing an iRule that previously existed, but has been deleted (or is being deleted as a result of a ConfigSync).

Conditions:
-- iRule using procedures in a different iRule.
-- iRule attached to virtual server.

Impact:
iRule procs are still referenced after deletion. Configuration validation fails spuriously.

Workaround:
Force reloading of the MCP binary database.

For specific steps, see K13030: Forcing the mcpd process to reload the BIG-IP configuration (https://support.f5.com/csp/article/K13030).


648879-1 : Linux kernel vulnerabilities: CVE-2016-6136 CVE-2016-9555

Solution Article: K90803619


648865-1 : Linux kernel vulnerability: CVE-2017-6074

Solution Article: K82508682


648316 : Flows using DEFLATE decompresion can generate error message during flow tear-down.

Component: TMOS

Symptoms:
Repeated entries in the ltm log will show a completion-code error (comp_code=4) as in the following:

  Zip engine ctx eviction (comp_code=4): ctx dropped.

Conditions:
The problem occurs when a flow that requests DEFLATE decompression is terminated when the compression engine is still in the middle of working on an incomplete DEFLATE block.

Impact:
False errors can appear:
  o In fields of tmctl rst_cause_stat table, false stats counters will increment for compression and packet errors.
  o Log entries with the "Zip engine... (comp_code=4)" appear in ltm log.

Monitors observing the ltm log or stats in the tmctl rst_cause_stat table will see false positives.

Workaround:
Disable hardware acceleration.

Fix:
A new tcl variable, nitrox::comp_suppress_itrunc, was added. It defaults to NO which yields legacy behavior. Setting it to YES causes comp_code=4 (ITRUNC) errors to not propagate as an error.

To enable the feature, add the following line to /config/tmm_init.tcl:

    nitrox::comp_suppress_itrunc yes

You will have to restart tmm for the change to take effect.


647944-3 : MCP may crash when making specific changes to a FIX profile attached to more than one virtual server

Component: TMOS

Symptoms:
When a FIX profile is attached to more than one virtual server, making specific edits to the profile may result in MCP crashing and restarting.

Conditions:
A FIX profile is be in use and attached to more than one virtual server. You then edit the profile (and click "Update") in this order:

- Change the Error Action from "Don't Forward" to "Drop Connection"
- Add a new mapping to the Sender and Tag Substitution Data Group Mapping.

Impact:
Traffic disrupted while mcpd restarts.

Fix:
Prevented MCP from crashing when the FIX profile is edited.


646604-3 : Client connection may hang when NTLM and OneConnect profiles used together

Solution Article: K21005334

Component: Local Traffic Manager

Symptoms:
In deployments where a NT LanManager (NTLM) authentication profile and a OneConnect profile are used together in a LTM virtual server to label an authenticated connection to a Domain Controller (DC); if the persisted connection to the DC is re-used, the connection may hang. A connection in this state may not be cleaned up by the sweeper, resulting in a memory leak.

Conditions:
The NTLM and OneConnect profiles are associated with a LTM virtual server.

Impact:
A client connection won't be serviced and TMM memory will leak. Over a long time period, this may result in more widespread service disruptions.

Workaround:
Avoid the use of OneConnect profiles on virtual servers that use NTLM profiles. The connections to the Domain Controller won't be pooled, but all other features will be retained.

Fix:
Fixed a problem that prevented NTLM and OneConnect profiles from working properly on the same LTM virtual server.


645684-1 : Flash application components are loaded into wrong ApplicationDomain after Portal Access rewriting.

Component: Access Policy Manager

Symptoms:
Flash ActionScript3 application components are loaded into incorrect ApplicationDomain and in some rare cases this may cause errors in application.

Conditions:
This can occur when viewing Flash video while connected to APM.

Impact:
Flash applications might fail to render through Portal Access.

Workaround:
None

Fix:
Flash files accessed through Portal Access are now loading components into correct Application Domain


645179-3 : Traffic group becomes active on more than one BIG-IP after a long uptime

Solution Article: K42751321

Component: TMOS

Symptoms:
Traffic-groups become active/active for 30 seconds after a long uptime interval.

Note: Uptime required to encounter this issue is dependent on the number of traffic groups: the more traffic groups, the shorter the uptime.

For example:

-- For 7 traffic groups, the interval is ~710 days.
-- For 15 traffic groups, the interval is ~331 days.

Conditions:
-- Two or more BIG-IP systems defined in a device group for sync/failover.
-- There is one or more traffic groups configured.
-- The BIG-IP systems have a long uptime.

Impact:
Outage due to traffic-group members being active on both systems at the same time.

Workaround:
There is no workaround.

The only option is to reboot all the BIG-IP units in the device group on a regular interval. The interval is directly dependent on the number of traffic groups.

Fix:
Traffic groups no longer becomes active on more than one BIG-IP system in a device group after a long uptime interval.


645101-4 : OpenSSL vulnerability CVE-2017-3732

Solution Article: K44512851


644970-2 : Editing a virtual server config loses SSL encryption on iSession connections

Component: Wan Optimization Manager

Symptoms:
Editing a virtual server configuration causes iSession connection resets or unencrypted iSession connections to be established, because the virtual server's dynamically configured default server-ssl profile has been deleted.

Conditions:
A virtual server has a server-side iSession profile with data-encrypt enabled. This virtual server also lacks client-ssl and server-ssl profiles.

Impact:
After editing the virtual server, iSession connections fail to be established if the destination iSession listener has a client-ssl profile with allow-non-ssl disabled. If the destination iSession listener has allow-non-ssl enabled, unencrypted iSession connections are established.

Workaround:
Modify the virtual server's configured server-side iSession profile. For example toggle the iSession profile from A to B and then back to A.

Fix:
Editing a virtual server configuration no longer deletes
an iSession dynamically configured default server-ssl profile.


644904-4 : tcpdump 4.9

Solution Article: K55129614


644693-4 : Fix for multiple CVE for openjdk-1.7.0

Solution Article: K15518610


644489-2 : Unencrypted iSession connection established even though data-encrypt configured in profile

Solution Article: K14899014

Component: Wan Optimization Manager

Symptoms:
iSession connections may be intermittently established as unencrypted even though they are configured to be secure.

Conditions:
Either of two scenarios can result in an unencrypted iSession connection being established:
    1) An error occurs during dynamic server-ssl profile replacement.
    2) Both the WOM local-endpoint and destination WOM remote-endpoint lack server-ssl profiles.

In both cases the virtual server must have a server-side iSession profile with data-encrypt enabled and the remote virtual must have a client-ssl profile with allow-non-ssl enabled.

Impact:
An unencrypted iSession connection may be established which is inconsistent with configuring data-encrypt as enabled in the sever-side iSession profile.

Workaround:
Configure the client-ssl profile with allow-non-ssl disabled (the default value) to reject non-SSL connections.

Fix:
The outgoing connection is aborted if the server-side iSession profile is configured with data-encrypt enabled and either of the two following scenarios occurs:
    1) The destination remote-endpoint and the local-endpoint lack server-ssl profiles.
    2) An error occurs during dynamic server-ssl profile replacement.


644220-2 : Flawed logic when retrieving an LTM Virtual Server's assigned Link on the LTM Virtual Server Properties page

Solution Article: K37049259

Component: Global Traffic Manager (DNS)

Symptoms:
Under LTM :: Virtual Servers :: Properties, the "Link" value sometimes displays "none" when it should display an actual link name.

Conditions:
This happens under certain configuration of Self IP / GTM Servers / GTM Links / LTM Virtual Servers.

Impact:
When conditions are met, the Virtual Server's link information displayed is not correct.

Workaround:
None.

Fix:
Virtual Server's assigned Link on the LTM Virtual Server Properties page is now displayed correctly.


644184-1 : ZebOS daemons hang while AgentX SNMP daemon is waiting.

Solution Article: K36427438

Component: TMOS

Symptoms:
ZebOS daemons hang while AgentX SNMP daemon is waiting for return from external script.

Conditions:
- Dynamic routing is enabled.
- SNMP is enabled.
- SNMP calls an external script that takes several moments to return.

Impact:
Dynamic routing may be halted for the duration of AgentX daemon waiting for return from external script.

Workaround:
Do not configure AgentX to call external scripts that take several moments to return.

Fix:
ZebOS daemons no longer hangs while AgentX is waiting.


643582-1 : Config load with large ssl profile configuration may cause tmm restart

Component: Local Traffic Manager

Symptoms:
When doing a config load with a large number of ssl profiles tmm may become busy enough to cause mcp tcp connection to go down and cause tmm restart.

Conditions:
Doing a full config load with large number of ssl profiles.

Impact:
Possible tmm restart.

Workaround:
Doing incremental sync of changes can avoid this issue.

Fix:
A full configuration reload with large number of ssl profiles may cause tmm restart.


643210-1 : Restarting MCPD on Secondary Slot of Chassis causes deletion of netHSM keys on SafeNet HSM

Solution Article: K45444280

Component: Local Traffic Manager

Symptoms:
When mcpd (re)starts on a secondary slot, part of the initialization process triggers the delete of any netHSM keys on the SafeNet HSM.

Conditions:
This occurs on a chassis that is configured to use a SafeNet netHSM.

Impact:
The key is removed from the HSM and must be reimported to the HSM from a backup, if it exists.

Workaround:
When rebooting a secondary blade, temporarily remove the BIG-IP from the network it uses to connect to the SafeNet HSM. Once the BIG-IP is Active, it is safe to reconnect it to the network.

Fix:
The BIG-IP no longer deletes keys from the Safenet HSM when the key is deleted from the BIG-IP system. Now, you must manually delete keys using fipskey.nethsm or 'cmu delete'.

Important! Delete operations cannot be undone. Before deleting keys on the HSM using one of these commands, make sure that the key is not used by any BIG-IP, because the key deletion on the HSM is irreversible.

Behavior Change:
Beginning with this release, the BIG-IP system will not delete a key from the SafeNet HSM when you delete the corresponding key on the BIG-IP system: You must manually delete the key on the HSM using either fipskey.nethsm or 'cmu delete'.

Important! Delete operations cannot be undone. Before deleting keys on the HSM using one of these commands, make sure that the key is not used by any BIG-IP, because the key deletion on the HSM is irreversible.


643187-3 : BIND vulnerability CVE-2017-3135

Solution Article: K80533167


642400-1 : Path MTU discovery occasionally fails

Component: Local Traffic Manager

Symptoms:
Connections using a TCP profile that receive an ICMP needsfrag message may incorrectly ignore the message. This may cause Path MTU discovery to fail.

Conditions:
TCP profile assigned to VIP. Smaller MTU on data path than on TCP endpoints.

Impact:
The connection may stall as large TCP segments are continually retransmitted.

Workaround:
Configure the MSS in the TCP profile to match the lowest MSS. Use or disable Path MTU discovery with the tm.pathmtudiscovery database key.

Fix:
Path MTU discovery functions correctly with the TCP profile.


641360-3 : SOCKS proxy protocol error

Solution Article: K30201296


640768-1 : Kernel vulnerability: CVE-2016-10088

Solution Article: K05513373


639617 : When AVR collect Page load time and/or session data the Content-Length can be set incorrectly

Component: Application Visibility and Reporting

Symptoms:
When the analytics profile with 'Page Load Time' and 'User Sessions' options is attached to a virtual server, sometimes it can incorrectly modify Content-Length for HTML responses. This might happen due to memory corruption.

Conditions:
AVR collect session and/or 'page load time' statistic.

Impact:
The response 'Content-Length' can be wrong.

Workaround:
Uncheck collect 'Page load time' and sessions on analytics profile.

Fix:
Potential memory corruption has been fixed. AVR sets the 'Content-Length' to the right value.


639395-1 : AVR does not display 'Max read latency' units.

Solution Article: K91614278

Component: Application Visibility and Reporting

Symptoms:
AVR does not display units for 'Max Read Latency'.

Conditions:
AVR, ASM, DoS, or AFM are provisioned.

Impact:
No units are displayed.

Workaround:
1. Edit the following file: /etc/avr/monpd/monp_disk_info_measures.cfg.
2. Add the following line at line 63: units=microsecond.
3. Restart monpd.

Fix:
Added units (microsecond) to AVR report.


638935-7 : Monitor with send/receive string containing double-quote may cause upgrade to fail.

Component: TMOS

Symptoms:
When you upgrade from an affected version, the config gets saved before moving to the new version, thus dropping the enclosing quotes and causing a load failure when booting into the new version.

Conditions:
Configuration where monitor string contains \" (backslash double-quote) but does not contain one of the following characters: ' (single quote), | (pipe), { (open brace), } (close brace), ; (semicolon), # (hashtag), literal newline, or literal space.

Impact:
Configuration fails to load.

Workaround:
Manually edit each string in the bigip.conf to include enclosing quotes in order to get the config to load the first time.

Fix:
Configs load successfully after upgrade. Surrounding quotes, if missing, are added to strings in the bigip.conf file after upgrade. For example:
\"service_status\":\"on\".+\"maintenance\":\"off\" in the recv, send recv-disable and username fields. Output of list ltm monitor and bigip.conf match. Reloading the same config via tmsh does not cause unintentional changes, such as losing a level of escape in monitor strings.

If you have an escaped quote in your configuration, and are moving to a configuration with this the dependency of this fix, you cannot reload the configuration or the license which also reloads the configuration. Doing so, will cause the config load to fail.


638780-1 : Handle 302 redirects for VMware Horizon View HTML5 client

Component: Access Policy Manager

Symptoms:
Starting from v4.4, Horizon View HTML5 client is using new URI for launching remote sessions, and supports 302 redirect from old URI for backward compatibility.

Conditions:
APM webtop with a VMware View resource assigned.
HTML5 client installed on backend is of version 4.4 or later.

Impact:
This fix allows for VMware HTML5 clients v4.4 or later to work properly through APM.

Workaround:
For versions 11.6.x and 12.x:
===============================

priority 2
when HTTP_REQUEST {
    regexp {(/f5vdifwd/vmview/[0-9a-f\-]{36})/} [HTTP::uri] vmview_html5_prefix dummy
}

when HTTP_RESPONSE {
    if { ([HTTP::status] == "302") && ([HTTP::header exists "Location"]) } {
        if { [info exists vmview_html5_prefix] } {
            set location [HTTP::header "Location"]
            set location_path [URI::path $location]
            if { $location_path starts_with "/portal/" } {
                set path_index [string first $location_path $location]
                set new_location [substr $location $path_index]
                regsub "/portal/" $new_location $vmview_html5_prefix new_location
                HTTP::header replace "Location" $new_location
            }
            unset vmview_html5_prefix
        }
    }
}

======================
For version 13.0:
priority 2
when HTTP_REQUEST {
    regexp {(/f5vdifwd/vmview/[0-9a-f\-]{36})/} [HTTP::uri] dummy vmview_html5_prefix
}

when HTTP_RESPONSE {
    if { ([HTTP::status] == "302") && ([HTTP::header exists "Location"]) } {
        if { [info exists vmview_html5_prefix] } {
            set location [HTTP::header "Location"]
            set location_path [URI::path $location]
            if { $location_path starts_with "/portal/" } {
                set path_index [string first $location_path $location]
                set new_location "$vmview_html5_prefix[substr $location $path_index]"
                HTTP::header replace "Location" $new_location
            }
            unset vmview_html5_prefix
        }
    }
}

Fix:
Handle 302 redirects for VMware View HTML5 client are now handled properly.


638570-2 : "ACCESS::session remove" hangs in ACCESS_POLICY_COMPLETED

Component: Access Policy Manager

Symptoms:
When "ACCESS:session remove" can hang if it is used within the the ACCESS_POLICY_COMPLETED event. Other commands within the event may not execute.

Conditions:
when ACCESS_POLICY_COMPLETED {
    ACCESS::session remove
}


This iRule was also observed to hang, with the client not receiving the 401 response:
when ACCESS_POLICY_COMPLETED {
    ACCESS::respond 401 content "Error denied..."
    ACCESS:session remove
}

Impact:
ACCESS::session remove cannot be used in the ACCESS_POLICY_COMPLETED event, which may break some use cases. Some Access Exchange iRules are broken from this.

Fix:
Processing of "ACCESS::session remove" was reverted to an earlier version that does not exhibit this behavior.


638556-3 : PHP Vulnerability: CVE-2016-10045

Solution Article: K73926196


638137-1 : CVE-2016-7117 CVE-2016-4998 CVE-2016-6828

Solution Article: K51201255


637666-3 : PHP Vulnerability: CVE-2016-10033

Solution Article: K74977440


637181-3 : VIP-on-VIP traffic may stall after routing updates

Component: Local Traffic Manager

Symptoms:
After a routing update traffic for an existing connection sent to a VIP-on-VIP virtual server may be sent directly to the destination address instead of to the inner virtual server.

Conditions:
VIP-on-VIP configuration and static or dynamic routing changes.

Impact:
Existing connections to the outer VIP may stall.

Workaround:
None.

Fix:
Connections to VIP-on-VIP virtual servers no longer stall after routing updates.


636702-2 : BIND vulnerability CVE-2016-9444

Solution Article: K40181790


636700-3 : BIND vulnerability CVE-2016-9147

Solution Article: K02138183


636699-4 : BIND vulnerability CVE-2016-9131

Solution Article: K86272821


635933-1 : The validation of ICMP messages for ePVA accelerated TCP connections needs to be configurable

Solution Article: K23440942 K13361021


635561-3 : Heavy URLs statistics are not shown after upgrade.

Component: Application Visibility and Reporting

Symptoms:
Heavy URLs statistics are not shown after upgrade.

Conditions:
Upgrading to newer version

Impact:
Missing statistics.

Workaround:
No workaround

Fix:
Upgrade and verify all heavy URLs statistics are shown.


635412-2 : Invalid mss with fast flow forwarding and software syn cookies

Solution Article: K82851041


635314-4 : vim Vulnerability: CVE-2016-1248

Solution Article: K22183127


635274-3 : SSL::sessionid command may return invalid values

Solution Article: K21514205

Component: Local Traffic Manager

Symptoms:
The SSL::sessionid iRule command might return random, invalid values.

Conditions:
An iRule exists that queries the SSL::sessionid.

Impact:
The iRule might not work as expected.

Workaround:
Do not use the SSL:sessionid iRule.

Fix:
The SSL::sessionid iRule returns the session ID as expected.


634371-3 : Cisco ethernet NIC driver

Component: TMOS

Symptoms:
The Cisco Ethernet NIC driver is version 2.1.1.67

Conditions:
N/A

Impact:
Cisco recommends using the updated version 2.3.0.12

Fix:
Cisco VIC Ethernet NIC Driver 2.3.0.12 is now used.


634259 : IP tuple nexthop object can be freed while still referenced by another structure

Component: Local Traffic Manager

Symptoms:
IP tuple nexthop object can be freed while still referenced by another structure.

Conditions:
This can happen if LSN is in use and the proxy connection takes some time to complete, creating a large enough time window where the nexthop object might be freed.

Impact:
The BIG-IP system might crash. This is a very timing/memory-usage dependent issue that is rarely encountered.

Workaround:
None.

Fix:
Management of IP tuple nexthop object reference counting is more consistent.


634001-1 : ASM restarts after deleting a VS that has an ASM security policy assigned to it

Component: Application Security Manager

Symptoms:
ASM restarts with the following errors:

'ltm' log error:
--------
err mcpd[9458]: 0107102e:3: gtm_vs_score refers to nonexistent virtual server (/<partition>/<app>/<vsname>).
--------

'ts_debug.log' error:
--------
asm|INFO|0107102e:3: gtm_vs_score refers to nonexistent virtual server (/<partition>/<app>/<vsname>).
--------

Conditions:
ASM provisioned
Deleting a virtual server that has an ASM security policy assigned to it.

Impact:
ASM restart

Workaround:
None.

Fix:
ASM no longer restarts when deleting a virtual server that has an ASM security policy assigned to it.


633723-2 : New diagnostics run when a crypto HA failure occurs and crypto.ha.action is reboot

Component: Local Traffic Manager

Symptoms:
A new db variable has been added to print diagnostic information when Cavium Nitrox devices encounter a "request queue stuck" error.

Conditions:
A Cavium Nitrox "request queue stuck" error occurs and the db variable "crypto.ha.action" is set to reboot.

I.e., when log message such as:
Feb 27 07:39:07 localhost crit tmm1[19936]: 01010260:2: Hardware Error(Co-Processor): cn1 request queue stuck

Impact:
Under the above conditions, the system will automatically run "nitrox_diag" to collect diagnostic information to help F5 determine the cause of the queue stuck error before rebooting.

The system will immediately failover to the standby system, but will then spend approximately one minute gathering diagnostic information beffore rebooting.

See https://support.f5.com/csp/article/K95944198 for more information about nitrox_diag.

Behavior Change:
Under rare conditions, the system will take approximately one additional minute to reboot.

If a Cavium Nitrox "request queue stuck" error occurs and the db variable "crypto.ha.action" is set to reboot, the system will automatically run "nitrox_diag" to collect diagnostic information to help F5 determine the cause of the queue stuck error before rebooting.

When the error happens, failover to the standby system will still happen immediately. The delay is only on rebooting the system which has already gone to standby mode.


632798-1 : Double-free may occur if Access initialization fails

Solution Article: K30710317

Component: Access Policy Manager

Symptoms:
Double-free may occur if Access initialization fails.

Conditions:
Access initialization failure occurs, possibly due to license issues.

Impact:
tmm crashes and cores. Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
This release fixes a double free condition so that the associated tmm crash no longer occurs.


631722-2 : Some HTTP statistics not displayed after upgrade

Component: Application Visibility and Reporting

Symptoms:
Some statistics will disappear after upgrade due to bug in HTTP statistics backup.

Conditions:
Upgrading to newer version

Impact:
Not all statistics are shown.

Workaround:
No workaround

Fix:
Fixed an issue where some ASM HTTP statistics would disappear after upgrade.


631688-4 : Multiple NTP vulnerabilities

Solution Article: K55405388 K87922456 K63326092 K51444934 K80996302


631627-5 : Applying BWC over route domain sometimes results in tmm not becoming ready on system start

Component: TMOS

Symptoms:
Rebooting after applying BWC to route domain stops vlan traffic on VCMP guest. You will experience connection failures when bandwidth Controller (bwc) and Web Accelerator are enabled.

Running the tmsh show sys ha-status all-properties command will indicate that tmm is in "ready-for-world", but the Fail status will read "Yes" when this is triggered.

Conditions:
BWC enabled and associated with a route domain, Web Accelerator is enabled, and the system is rebooted.

Impact:
The system does not comes up fully. TMM does not reach a ready state and will not pass traffic.

Workaround:
Remove BWC from route domain and then reapply the BWC back.

Fix:
BWC enabled and associated with a route domain, Web Accelerator enabled, and the system is rebooted, now results in the system and TMM coming up fully and passing traffic.


631582-4 : Administrative interface enhancement

Solution Article: K55792317


630475-4 : TMM Crash

Solution Article: K13421245


628164-2 : OSPF with multiple processes may incorrectly redistribute routes

Component: TMOS

Symptoms:
When OSPF is configured with multiple processes that each redistribute different type routes, LSAs may be created in a process for a route of the type other than the one configured for redistribution into that process.

Conditions:
OSPF routing with multiple processes configured. Each OSPF process configured with a different route type redistributed.

Impact:
Incorrect routing information in the network when OSPF converges.

Workaround:
Redistribute the leaked route type into the affected OSPF process and use a route map that filters out all routes.

Fix:
OSPF no longer leaks LSAs between processes redistributing different types of routes.


626360-5 : TMM may crash when processing HTTP2 traffic

Solution Article: K22541983


625832-2 : A false positive modified domain cookie violation

Solution Article: K89255958

Component: Application Security Manager

Symptoms:
An unexpected modified domain cookie violation on system that has more than 127 policies configured.

Conditions:
This occurs when more than 127 policies are configured. The violation modified domain cookie is turned on and there are enforced cookies.

Impact:
A false positive violation.

Workaround:
Remove the modified domain cookie violation from blocking.

Fix:
Fixed a false positive modified domain cookie violation.


625824-3 : iControl calls related to key and certificate management (Management::KeyCertificate) might leak memory

Component: TMOS

Symptoms:
iControl calls related to Management::KeyCertificate might leak memory slowly, that causes swap space to increase continuously and might lead to exhaustion of swap space

Conditions:
This occurs with the iControl command bigip.Management.KeyCertificate.certificate_export_to_pem

Impact:
iControlPortal.cgi memory increases

Workaround:
Restart httpd to reload the iControl daemon.

Fix:
Fixed a memory leak associated with iControl


625376-1 : In some cases, download of PAC file by edge client may fail

Component: Access Policy Manager

Symptoms:
Edge client may fail to download PAC file and incorrectly apply proxy configuration after VPN connection.

Conditions:
- User machine proxy configuration points to a proxy auto configuration file.
- Network access proxy configuration points to a proxy auto configuration file.
- PAC file URI in either case has uppercase characters.
- PAC file is hosted on a server where resource names are case sensitive.

Impact:
PAC file download will fail and client will use incorrect proxy settings due to unavailability of PAC file.

Workaround:
Use only lowercase characters in PAC file URI.

Fix:
Now Edge client can download PAC files from URIs that have uppercase as well as lowercase characters.


625372-2 : OpenSSL vulnerability CVE-2016-2179

Solution Article: K23512141


625198-3 : TMM might crash when TCP DSACK is enabled

Component: Local Traffic Manager

Symptoms:
TMM crashes

Conditions:
All of the below are required to see this behavior:

DSACK is enabled

MPTCP, rate-pace, tail-loss-probe, and fast-open are disabled.

cmetrics-cache-timeout is set to zero; congestion control is high-speed, new-reno, reno, or scalable; AND Nagle is not set to 'auto'.

an iRule exists that changes any of the conditions above besides DSACK.

various client packet combinations interact in certain ways with the iRule logic.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Change any of the conditions above.

Fix:
TCP maintains state appropriately to avoid crash.


624903-3 : Improved handling of crypto hardware decrypt failures on 2000s/2200s or 4000s/4200v platforms.

Component: Local Traffic Manager

Symptoms:
Under rare circumstances some AES-GCM SSL connections can result in a bad record.

Conditions:
AES-GCM SSL record with irregular payload component on a BIG-IP platforms 2000s/2200s or 4000s/4200v.

Impact:
Bad record errors.

Workaround:
None.

Fix:
Irregular SSL payload components are detected, accounted for, and no longer result in a bad record.


624616-3 : Safenet uninstall is unable to remove libgem.so

Component: Local Traffic Manager

Symptoms:
When uninstalling Safenet client 6.2 from a BIG-IP chassis, it can't remove libgem.so and generates the following error:

rm: cannot remove `/usr/lib64/openssl/engines/libgem.so': Read-only file system.

Conditions:
This can be triggered when uninstalling the safenet client using the command safenet-sync.sh -u.

Impact:
Uninstall is unable to complete.

Workaround:
None.

Fix:
When uninstalling Safenet client 6.2 from a BIG-IP chassis, the system can now remove libgem.so, so there is no error condition, and uninstall can complete as expected.


624570-3 : BIND vulnerability CVE-2016-8864

Solution Article: K35322517


624526-1 : TMM core in mptcp

Solution Article: K10002335


624457-3 : Linux privilege-escalation vulnerability (Dirty COW) CVE-2016-5195

Solution Article: K10558632


624263-3 : iControl REST API sets non-default profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets profile's non-default property value as "none"; properties missing in iControl REST API response

Component: TMOS

Symptoms:
For profiles, iControl REST does not provide visibility for profile property override when "none" is specified, including references, passwords, and array of strings.

Conditions:
-- Use iControl REST API.
-- string, enum, or vector of enum/string property explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf.

Impact:
The iControl REST API response skips these elements. iControl REST does not provide visibility for profile property overrides.

Workaround:
None.

Fix:
iControl REST API now returns elements (i.e., string, enum, or vector of enum/string property that is explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf) with a value "none". The exclusion to this policy is the secured attributes. Secured attributes are always excluded from the iControl REST API response.


624245 : Hung tasks leading to system problems and lack of management access via ssh/GUI

Component: TMOS

Symptoms:
Problems with bigd, snmpd and other daemons. System becomes inaccessible via ssh and GUI.

Hung tasks recorded in kern logs, typically snmpd, bigd, chmand, big3d hung.

Caused by Centos kernel bug in netlink code where mutex is left locked on error path.

Conditions:
Seen when a system is handling heavy SNMP traffic and memory is low.

Impact:
SNMP traffic fails with hung tasks. Reboot required.

Workaround:
Apparently reducing SNMP load helps avoid/postpone the problem.


624193-1 : Topology load balancing not working as expected

Component: Global Traffic Manager (DNS)

Symptoms:
Under certain conditions, load balancing decisions can result in an unequal or unexpected distribution.

Conditions:
Occurs when topology load balancing is used for a wide IP and more than one pool share the highest assigned score for a particular load balancing decision.

Impact:
The resulting load balancing decisions can lead to an unequal or unexpected distribution of pool selections.

Workaround:
Topology records and pools can be configured to avoid the conditions which cause the condition.

Fix:
A system DB variable, gtm.wideiptoporandom, has been added. When this system DB variable is assigned the value of "enable" and more than one pool shares the highest assigned score for a given load balancing decision, a random pool is selected.


624091 : DHCP relay is not forwarding all of the DHCPOFFERS to clients

Component: Policy Enforcement Manager

Symptoms:
When upgrading from v11.5.3 to v11.6.1, DHCPOFFER packets got silently dropped.

Conditions:
If DHCP clients send broadcast DHCP packets with non-zero unicast source IP address via BIG-IP, and regular DHCP discovery packets(0.0.0.0 source IP addrees), multiple client connection flows are created, after some are aged out, BIG-IP may stop relay DHCP server replies back to clients.

Impact:
BIG-IP will stop to relay DHCPOFFER and DHCPACK back
to DHCP clients

Workaround:
Manually delete all system connection flows by doing "delete sys conn" under tmsh.


623562-1 : Large POSTs rejected after policy already completed

Component: Access Policy Manager

Symptoms:
When the policy has already completed, access still rejects POSTs greater than 64k. Client will see a reset, and these error messages will appear on the BIG-IP:

/var/log/ltm
Oct 18 19:10:04 bigip6 err tmm[14242]: 01230140:3: RST sent from 10.2.61.80:8080 to 10.2.61.10:55280, [0x1d4cb2c:2863] APM HTTP body too big

/var/log/apm
Oct 19 09:42:37 bigip3922mgmt err tmm1[7636]: 01490514:3: (null):Common:00000000: Access encountered error: ERR_NOT_SUPPORTED. File: ../modules/hudfilter/access/access.c, Function: hud_access_process_ingress, Line: 2960

Conditions:
Policy has already been fully evaluated to allow. Then the client sends a large POST. Only applies to POSTs made to '/'. Would not apply if the URL is something else like '/test'. Also does not apply to clientless modes, where the db key tmm.access.maxrequestbodysize can be used to increase the maximum POST body size allowed.

Impact:
Clients are unable to send POST bodies to '/' that are larger than 64kb, even though the policy has already been evaluated to allow.

Workaround:
Move the resource from '/' to another URL.

Fix:
The logic of '/' in this area was changed to be consistent with other URLs.


623401-4 : Intermittent OCSP request failures due to non-optimal default TCP profile setting

Component: TMOS

Symptoms:
The connection between BIG-IP and OCSP responder is not reliable since it uses the default internal TCP configuration which doesn't fit the usage well.

Conditions:
When the OCSP stapling option is enabled in the clientSSL profile that is in use by a virtual server.

Impact:
The BIG-IP as a SSL server fails to staple the OCSP response to the SSL client. In other words, the certificate status messages are not added in the Server Hello message in the TLS handshakes to the SSL client.

Workaround:
The fix proposed an optimal TCP configuration used by the connection between BIG-IP and OCSP responder which makes the connection reliable now. Therefore the virtual server can now always correctly staple the certificate status in the Server Hello message to the SSL client.


623135 : BIG-IP virtual server TCP sequence numbers vulnerability (CVE-2002-1463)

Solution Article: K68401558

Component: Local Traffic Manager

Symptoms:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

Conditions:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

Impact:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

Fix:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html


623119-6 : Linux kernel vulnerability CVE-2016-4470

Solution Article: K55672042


622830 : LDAP type CRLDP is parsed incorrectly

Solution Article: K20488861

Component: Access Policy Manager

Symptoms:
After upgrading to 11.6.1 HF1, CRLDP authentication stopped working.

It can be seen from following sample log that the URL is not parsed correctly:

warning apd[15314]: 0149015e:4: fc98d22d: CRLDP Auth agent: CRL lookup failed for LDAP url 'ldap::::389//crl.certificate.../..../certificaterevocationlist?certificateRevocationList' reason 'Invalid CRLDP URL.

Conditions:
The problem occurs only when LDAP type CRLDP is available in the client certificate and it is used from the CRL Distribution Points list.

Impact:
Users may fail access policy evaluation when client certification is used.

Workaround:
Configure other than LDAP type distribution points in the Certificate or if multiple distribution points are present in the client certificate, make sure other than LDAP type scheme succeeds before hitting LDAP CRLDP.

Fix:
The system now parses LDAP type CRLDP URL correctly, so after upgrading, CRLDP authentication now works as expected.


622496-6 : Linux kernel vulnerability CVE-2016-5829

Solution Article: K28056114


622244-1 : Edge client can fail to upgrade when always connected is selected

Component: Access Policy Manager

Symptoms:
Attempt to upgrade an Edge client may fail if the Always Connected mode is enabled

Conditions:
Always Connected is selected in BIG-IP when upgrading the client

Impact:
Upgrade will fail

Workaround:
Disable the Always Connected mode

Fix:
Upgrade functions as intended regardless of connection mode


622178-3 : Improve flow handling when Autolasthop is disabled

Component: Local Traffic Manager

Symptoms:
Modifications made to improve flow handling in configurations which disabled Autolasthop.

Conditions:
Autolasthop disabled.

Impact:
Modifications made to improve flow handling in configurations which disabled Autolasthop.


622166 : HTTP GET requests with HTTP::cookie iRule command receive no response

Component: Local Traffic Manager

Symptoms:
HTTP GET requests to virtual servers using the command "HTTP::cookie <name> <value>" in HTTP_REQUEST iRule event handlers do not get a response.

Conditions:
An LTM virtual server with an iRule including the HTTP::cookie command.

Impact:
No response is received by the client.

Workaround:
None.

Fix:
HTTP GET requests to virtual servers using the command "HTTP::cookie <name> <value>" in HTTP_REQUEST iRule event handlers now get a response as expected.


622133-4 : VCMP guests may incorrectly obtain incorrect MAC addresses

Component: TMOS

Symptoms:
vCMP guests may be re-configured to use MAC addresses based off an all zero MAC address (00:00:00:00:00:00).

The 'tmsh show net vlan' command will show the vlan interfaces having mostly 0's in the MAC address:

-------------------------------------
Net::Vlan: external
-------------------------------------
Interface Name external
Mac Address (True) 00:00:00:00:00:01
MTU 1500
Tag 3702
Customer-Tag

-------------------------------------
Net::Vlan: internal
-------------------------------------
Interface Name internal
Mac Address (True) 00:00:00:00:00:02
MTU 1500
Tag 3703
Customer-Tag

Conditions:
For this to manifest the vCMP host vcmpd process will have to have had a prior crash or be killed.
In this scenario vcmpd on restart uses a default zero-base MAC address for the guests.
The guests will not use the new zero-based MAC until services are restarted on the guest, on which the new MAC address will take effect.

Impact:
This can cause network issues and conflicts if occurring on multiple guests in the same VLAN as the same MAC addresses will be used.

Workaround:
Restart the guest from the hypervisor.

Fix:
vCMP no longer uses zero-based MACs on vcmpd crash/kill.


622126-3 : PHP vulnerability CVE-2016-7124

Solution Article: K54308010


621935-3 : OpenSSL vulnerability CVE-2016-6304

Solution Article: K54211024


621524-3 : Processing Timeout When Viewing a Request with 300+ Violations

Component: Application Security Manager

Symptoms:
When attempting to view a request that triggered hundreds or thousands of violations, a timeout is encountered.

Conditions:
Attempting to view a request that triggered hundreds or thousands of violations

Impact:
A timeout is encountered.

Workaround:
increase the "max_execution_time" timeout in /usr/loca/lib/php.ini from 30 to 240 seconds.

Fix:
Processing high violation requests is now more efficient.


621417-1 : sys-icheck error for /usr/share/defaults/bigip_base.conf in AWS.

Component: TMOS

Symptoms:
On a BIG-IP deployed in AWS cloud, sys-icheck reports size an md5 errors for /usr/share/defaults/BIG-IP_base.conf file as following:

ERROR: S.5...... c /usr/share/defaults/BIG-IP_base.conf (no backup)

Conditions:
BIG-IP deployed in AWS cloud.

Impact:
sys-icheck reports "rpm --verify" size and md5 errors for /usr/share/defaults/BIG-IP_base.conf. This doesn't have any functional impact on the product but looks like factory config file was modified incorrectly by a user/application.

Workaround:
No workaround exists for this issue.

Fix:
sys-icheck error for /usr/share/defaults/BIG-IP_base.conf in AWS.


621273-4 : DSR tunnels with transparent monitors may cause TMM crash.

Component: TMOS

Symptoms:
The TMM may crash if the BIG-IP system is configured with a DSR tunnel with a transparent monitor.

Conditions:
The BIG-IP system is configured with a DSR tunnel with a transparent monitor and the DB variable tm.monitorencap is set to "enable".

Impact:
Traffic disrupted while tmm restarts.

Fix:
The TMM does not crash.


621242 : Reserve enough space in the image for future upgrades.

Component: TMOS

Symptoms:
Increased the reserved free space in VM image from 15% to 30% to accommodate upgrades to future versions. Each next version tends to be bigger and require more disk space to install. The increased reserved space will allow upgrading to at least next 2 versions.

Conditions:
VE in local hypervisors and VE in the Cloud (AWS, Azure).

Impact:
Extends the disk image to reserve more disk space for upgrades.

Workaround:
N/A

Fix:
Increased the reserved free space on VE images.


621239-1 : Certain DNS queries bypass DNS Cache RPZ filter.

Component: Global Traffic Manager (DNS)

Symptoms:
A DNS query with the DO-bit set to 1 will bypass the RPZ filter on a DNS Cache.

Conditions:
A DNS Cache configured with RPZ.

Impact:
Queries with DO-bit set to 1 will bypass the RPZ filter and be answered normally.

Fix:
The DO-bit is now ignored with respect to RPZ filtering.


621202-1 : Portal Access: document.write() with very long string as argument may be handled incorrectly.

Component: Access Policy Manager

Symptoms:
JavaScript code may include document.write() calls with very long strings (> 60K). In some cases these strings may be rewritten incorrectly.

Conditions:
- document.write() with very long string as argument.
- argument string contains HTML tags with quoted attribute values which include '>' inside.

Impact:
rewritten HTML page may not work correctly.

Fix:
Now document.write() calls with long HTML strings are handled correctly by Portal Access.


620922-1 : Online help for Network Access needs update

Component: Access Policy Manager

Symptoms:
Online help for advanced network settings does not tell users that if they fill in the DNS Address Space setting, they also need to install the DNS Relay Proxy service on Windows-based systems to get the desired result.

Conditions:
Split tunneling configured. Windows-based system in use. DNS Address Space setting filled in.

Impact:
Use of DNS Address Space setting does not provide the expected result.

Workaround:
Install the DNS Relay Proxy server on Windows-based systems.

Fix:
Network Access online help now states that for DNS Address Space to work properly on a Windows-based system, the DNS Relay Proxy service must be installed and running on the client.


620829-4 : Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly

Component: Access Policy Manager

Symptoms:
JavaScript code with literal object definition containing field names equal to reserved keywords is not handled correctly by Portal Access.

Conditions:
JavaScript code with literal object definition containing fields with reserved keywords as a name, for example:

var a = { default: 1, continue: 2 };

Impact:
JavaScript code is not rewritten and may not work correctly.

Workaround:
None.

Fix:
Now JavaScript with literal object definition containing reserved keywords as field names is handled correctly by Portal Access.


620712-1 : Added better search capabilities on the Pool Members Manage & Pool Create page.

Component: Global Traffic Manager (DNS)

Symptoms:
Large amount of virtual servers were hard to manage on the GSLB Pool Member Manage page.

Conditions:
Having large amount of virtual servers/wide ips

Impact:
Poor usability.

Workaround:
No workaround.

Fix:
The GSLB Pool Member Manage page now has a new search feature in the form of a combo box to allow for better management of large amount of virtual servers.

Behavior Change:
The GSLB Pool Member Manage page now has the new search feature to allow for better management of large amount of virtual servers.


620614-2 : Citrix PNAgent replacement mode: iOS Citrix receiver fails to add new store account

Component: Access Policy Manager

Symptoms:
iOS Citrix receiver fails to add new store account and touching on the Save option after providing the credentials displays "Loading" and comes back to previous save option.

/var/log/apm displays "An exception is thrown: EVP_CipherFinal_ex failed: EVP_DecryptFinal_ex:bad decrypt" from VDI.

The above error, otherwise, below error which deletes the session id abruptly.

Oct 24 16:33:12 slot2/vip-guest7-test notice tmm[11547]: 01490567:5: /Common/mvdi-r_ap:Common:e19516fd: Session deleted (internal_cause).

Conditions:
APM is configured with Citrix replacement mode. Provide wrong passcode values for RSA SecurId auth for continuously three times which trigger the next token input for the fourth time entering the right passcode. APM rotate session is enabled.

Impact:
iOS Citrix receiver could not add the account after providing wrong token values for two factor auth

Workaround:
Kill the iOS Citrix receiver application and click on the receiver again to add the account.

Fix:
Use the right session id for decrypting the password.


620215-3 : TMM out of memory causes core in DNS cache

Component: Global Traffic Manager (DNS)

Symptoms:
The TMM crashes and service is lost until it restarts. You may see several "aggressive mode sweeper" messages in /var/log/ltm prior to the crash.

Conditions:
This can occur when the TMM memory is exhausted.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Provision sufficient memory for the TMM or reduce load.

Fix:
The fix was to properly handle the failure allocating memory.


619879-3 : HTTP iRule commands could lead to WEBSSO plugin being invoked

Component: Access Policy Manager

Symptoms:
With SSO logs set to 'Debug' in Access log configuration, the following log messages are seen in '/var/log/apm':
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: constructor
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: webssoContext constructor ...
Sep 30 12:46:17 bigip3900mgmt err websso.3[14520]: 014d0005:3: Unsupported SSO Method
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: ctx: 0x914b510, SERVER: TMEVT_REQUEST
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: ctx: 0x914a718, CLIENT: TMEVT_ABORT_PROXY
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: webssoContext destructor ...
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: webssoConfig destructor

With 'rstcause' enabled, the following log message is seen in '/var/log/ltm':
Sep 30 12:46:17 bigip3900mgmt err tmm2[13116]: 01230140:3: RST sent from 172.17.90.92:57611 to 127.0.0.1:10001, [0x24ccbbc:820] Internal error (APM::WEBSSO requested abort (Unsupported SSO Method))

Conditions:
HTTP::disable followed by HTTP::enable.

when CLIENT_ACCEPTED {
    HTTP::disable
    // do some other stuff
    HTTP::enable
}

Impact:
client receives a HTTP 503 reset

Workaround:
When the access profile is added to the virtual server, the websso plugin profile is automatically added. Manually removing the websso plugin fixes this bug.

Fix:
The server-side access hudfilter was mistakenly enabling the websso plugin. The logic has been updated so that this does not happen.


619757-3 : iSession causes routing entry to be prematurely freed

Component: Wan Optimization Manager

Symptoms:
iSession may cause TMM to prematurely free a routing entry resulting in memory corruption and TMM restarting.

Conditions:
iSession-enabled virtual.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
No reasonable workaround short of not using iSession functionality.

Fix:
iSession no longer causes routing entries to be prematurely freed.


619710 : GUI gives error when clicking "Update" making changes to VS in Security-Policies

Component: Advanced Firewall Manager

Symptoms:
GUI times out and generates an error when ASM policy takes longer time to update (in Virtual Server Security page)

Conditions:
When the same ASM policy is attached to hundreds of virtual servers, it takes longer to update.

Impact:
GUI times out before the changes are saved. Users will be able to see the updated changes only after refreshing the page.

Workaround:
Refresh the page in the browser once the error shows up.

Fix:
GUI doesn't time out when ASM policy is updated.


619528-2 : TMM may accumulate internal events resulting in TMM restart

Component: Local Traffic Manager

Symptoms:
Under some uncommon circumstances, long-lived connections may cause internal events to be accumulated causing excessive memory usage potentially resulting in TMM restarting.

Conditions:
HTTP virtual with long-lived connections.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
The issue can be mitigated by setting the HTTP 'max-requests' profile option to a reasonably low value - this value will depend on application requirements.

Fix:
Internal events are no longer accumulated thus avoiding low memory conditions.


619486-1 : Scripts on rewritten pages could fail with JavaScript exception if application code modifies window.self

Component: Access Policy Manager

Symptoms:
Attempts to call some JavaScript methods (such as XMLHttpRequest.open) on a page accessed through Portal Access could fail if application modifies window.self builtin object. As a result, the application will stop working and optionally log an undefined variable/reference exception into Developer Tools console.

To verify that window.self is modified, run 'window.self == window' command in Developer Tools console of the page with error and check if it returns 'false'.

Conditions:
This can occur if a web application has javascript that modifies the value of window.self.

Impact:
Affected web-applications will not work when accessed through Portal Access.

Workaround:
None

Fix:
Scripts on pages accessed through Portal Access are no longer failing when web application code modifies window.self.


619398-4 : TMM out of memory causes core in DNS cache

Component: Global Traffic Manager (DNS)

Symptoms:
The TMM crashes and service is lost until it restarts. You may see several "aggressive mode sweeper" messages in /var/log/ltm prior to the crash.

Conditions:
This can occur when the TMM memory is exhausted.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Provision sufficient memory for the TMM or reduce load.

Fix:
The fix was to properly handle the failure allocating memory.


619060-2 : Reduction in boot time in BIG-IP Virtual Edition platforms

Component: TMOS

Symptoms:
BIG-IP Virtual Edition (VE) version has experienced increased boot time.

Conditions:
The increased boot time occurs each time a VE is booted.

Impact:
Long boot time, longer than previous releases.

Workaround:
None.

Fix:
Reduction in boot time in BIG-IP Virtual Edition platforms.


618905-3 : tmm core while installing Safenet 6.2 client

Component: Local Traffic Manager

Symptoms:
tmm core while installing Safenet 6.2 client.

Conditions:
Safenet 6.2 client installation

Impact:
Traffic disrupted while tmm restarts.

Fix:
Fixed a tmm core related to Safenet 6.2 client installation.


618902-3 : PCCD memory usage increases on configuration changes and recompilation due to small amount of memory leak on each compilation

Component: Advanced Firewall Manager

Symptoms:
Each time the Packet Classification Compiler Daemon (PCCD) process recompiles rules due to configuration changes, it loses approximately 20 bytes or more (depends on the rule complexity) due to small memory leak.

Conditions:
This occurs when making changes to the firewall configuration when AFM is configured.

Impact:
This can potentially lead to an out-of-memory situation if the system runs for a long time without reboot and PCCD continuously recompiles due to frequent configuration changes.

Workaround:
None.

Fix:
The PCCD memory leak was identified and fixed.


618771-2 : Some Social Security Numbers are not being masked

Component: Application Security Manager

Symptoms:
ASM does not block or mask some SSN numbers.

Conditions:
The Data Guard feature is turned on and set to Block, Alarm or Mask. The responses contains social security numbers with specific ranges.

Impact:
The traffic passes neither masked nor blocked to the end client.

Workaround:
None.

Fix:
The system now correctly masks and/or blocks all relevant social security numbers.


618517-2 : bigd may falsely complain of a file descriptor leak when it cannot open its debug log file

Component: Local Traffic Manager

Symptoms:
- On 11.6.1, bigd will report erroneously mark pool members down and messags similar to the following will be seen in the ltm log file:

Sep 23 10:45:59 bipve1 warning bigd[7413]: 01060154:4: Bigd PID 7413 throttling monitor instance probe because file descriptor limit 65436 reached.

- On 12.1.x, this bug has negligible impact.

Conditions:
Monitoring must be in use, bigd debug logging must be enabled, and the bigd debug log file (/var/log/bigdlog) must be full.

Impact:
- On 11.6.1 this can cause bigd to stop monitoring, resulting in pool members being marked down erroneously.

- In 12.1.x, some of the underlying logging code changed and there is no real impact.

Workaround:
You can rotate the log file, using the following command:
logrotate -f bigdlog

Fix:
Stopped bigd from thinking it was out of file descriptors when it was unable to open its debug log file.


618324-2 : Unknown/Undefined OPSWAT ID show up as 'Any' in APM Visual Policy Editor

Component: Access Policy Manager

Symptoms:
When upgrading from OPSWAT SDK V3 to V4, opening Access Policy in VPE if one of the opswat checker (e.g. Anti-Virus checker) contains an Undefined (i.e. previously defined but out of support) ID it will display as "Any." The correct display should be "Unsupported" or "Invalid" product.

Conditions:
Wrongful information displayed.

Impact:
Wrongful information displayed.

Workaround:
N/A

Fix:
Correct (*** Invalid ***) information displayed.


618261-3 : OpenSSL vulnerability CVE-2016-2182

Solution Article: K01276005


618170-1 : Some URL unwrapping functions can behave bad

Component: Access Policy Manager

Symptoms:
Some URL unwrapping functions can behave incorrectly with different web application malfunctions as a result.

Conditions:
JavaScript with "location.pathname" like fields at the right side of an expression.

Impact:
Different web application malfunctions. One example is SharePoint 2010 using IE11, clicking the Edit button results in "Only secure content is displayed" at the bottom of the page.

Fix:
Fixed.


617862-1 : Fastl4 handshake timeout is absolute instead of relative

Component: Local Traffic Manager

Symptoms:
TCP connections that are pending completion of the three-way handshake are expired based on the absolute value of handshake timeout. For example, if handshake timeout is 5 seconds, then the connection is reset after 5 seconds of receiving the initial SYN from the client.

Conditions:
A TCP connection in three-way handshake.

Impact:
Connections are expired prematurely if they are still in three-way handshake.

Workaround:
Disable handshake timeout.

Impact of workaround: Your TCP handshake will not prematurely timeout and connections remains open until the Idle Timeout expires.

Fix:
The handshake timeout now expires based on idleness of the connection, taking into consideration of any SYN retransmissions, etc., that might occur.


617858-1 : bigd core when using Tcl monitors

Component: Local Traffic Manager

Symptoms:
If a Tcl monitor encounters an error, it may exit with an assert which causes bigd to core.

Conditions:
This can occur rarely when Tcl monitors are in use (specifically, SMTP, FTP, IMAP, POP3 monitors).

Impact:
bigd can core, which temporarily suspends monitoring while bigd restarts.

Workaround:
None.

Fix:
Now, when a Tcl monitor encounters an error, it no longer exits with an assert, so bigd no longer cores.


617824-2 : "SSL::disable/enable serverside" + oneconnect reuse is broken

Component: Local Traffic Manager

Symptoms:
If "SSL::disable/enable serverside" is configured in an iRule and oneConnect is configured in the iRule or in the Virtual Server profile, BIG-IP may not receive the backend server's HTTP response for every client's HTTP Request.

Conditions:
1. "SSL::disable/enable serverside" exists in the iRule
2. OneConnect is configured in the iRule or in the VS profile
3. apply the iRule and oneConnect Profile to the VS.

Impact:
The oneConnect behavior is unexpected, and may not get the backend Server's HTTP response for every client's HTTP Request.

Workaround:
You can work around the problem by disabling oneConnect.


617628-2 : SNMP reports incorrect value for sysBladeTempTemperature OID

Component: TMOS

Symptoms:
SNMP reports incorrect value for sysBladeTempTemperature OID, while TMSH reports the corresponding value correctly.

# snmpwalk -v2c -c public localhost .1.3.6.1.4.1.3375.2.1.3.2.4.2.1.2.8.1
F5-BIGIP-SYSTEM-MIB::sysBladeTempTemperature.8.1 = Gauge32: 4294967245

# tmsh show sys hardware

Sys::Hardware
Blade Temperature Status
  Slot Index Lo Limit(C) Temp(degC) Hi Limit(C) Location
...
  1 8 0 -48 0 Blade CPU #1 TControl Delta tem
...

The negative "Blade CPU #1 TControl Delta" temperature is being incorrectly reported as a large positive temperature by SNMP.

Impact:
A negative temperature may be incorrectly reported by SNMP as an impossibly high positive value.

Workaround:
Use tmsh show sys hardware to view blade temperatures. Negative temperatures are properly reported.

config # tmsh show /sys hardware
Sys::Hardware
Blade Temperature Status
  Slot Index Lo Limit(C) Temp(degC) Hi Limit(C) Location
  1 1 0 19 49 Blade air outlet temperature 1
  1 2 0 14 41 Blade air inlet temperature 1
  1 3 0 21 57 Blade air outlet temperature 2
  1 4 0 16 41 Blade air inlet temperature 2
  1 5 0 25 60 Mezzanine air outlet temperatur
  1 6 0 27 72 Mezzanine HSB temperature 1
  1 7 0 17 63 Blade PECI-Bridge local tempera
  1 8 0 -48 0 Blade CPU #1 TControl Delta tem
  1 9 0 25 68 Mezzanine BCM56846 proximity te
  1 10 0 22 69 Mezzanine BCM5718 proximity tem
  1 11 0 19 57 Mezzanine Nitrox3 proximity tem
  1 12 0 16 46 Mezzanine SHT21 Temperature


617316-1 : Desktop title is garbled for Citrix Storefront integration mode with non-sta configuration

Component: Access Policy Manager

Symptoms:
Desktop launched from browser or from native receiver has garbled title.

Conditions:
Citrix storefront integration mode through APM with no STA configured. Double byte language such as Japanese character set is used in the backend.

Impact:
Desktop title is not shown properly.

Workaround:
None

Fix:
Double byte character language title is shown properly


617310-1 : Edge client can fail to upgrade when Always Connected is selected

Component: Access Policy Manager

Symptoms:
Attempt to upgrade from an Edge client version to a current version fails when Always Connected is enabled

Conditions:
Always Connected is selected in BIG-IP when upgrading the client.

Impact:
Upgrade fails. Must turn off Always Connected to upgrade client.

Workaround:
Turn off Always Connected before upgrading.

Fix:
Edge client now succeeds during upgrade when Always Connected is selected.


617002-3 : SWG with Response Analytics agent in a Per-Request policy fails with some URLs

Component: Access Policy Manager

Symptoms:
SWG with Response Analytics agent in a Per-Request policy fails with some URLs

Conditions:
Response analytics agent is added to per-request policy and per-request policy is attached to the virtual. APM and SWG are provisioned and licensed.

Impact:
Client might receive resets for some URLs when response analytics doesn't function correctly.

Workaround:
Remove response analytics agent from the per-request policy and perform categorization based only on URLs.

Fix:
Correctly handle the response analytics for these URLs and dont send resets to client.


616864-3 : BIND vulnerability CVE-2016-2776

Solution Article: K18829561


616838 : Citrix Remote desktop resource custom parameter name does not accept hyphen character

Component: Access Policy Manager

Symptoms:
While adding the custom parameter in Citrix Resource would give parser error as following,

01070734:3: Configuration error: apm resource remote-desktop /Common/ctx_resource: Parse error on line 1: DesktopViewer-ForceFullScreenStartup=On"

Conditions:
Having Citrix resource with custom parameter name with hyphen character

Impact:
Custom parameter can not be used with hyphen character

Workaround:
None

Fix:
Accept custom parameter name with hyphen character


616242-2 : basic_string::compare error in encrypted SSL key file if the first line of the file is blank

Solution Article: K39944245

Component: TMOS

Symptoms:
Trying to load a configuration that references an encrypted SSL key file may fail if the first line of the SSL key file is blank. When this occurs, the system will report a vague error message:

    01070711:3: basic_string::compare

If this happens during an upgrade, the system will not load the configuration under the new software version, and will remain inoperative.

Conditions:
This can occur if an affected configuration is present on a system running BIG-IP v11.3.0 or earlier, and is upgraded to BIG-IP v11.4.0 through v12.1.1.

Impact:
Configuration fails to load on upgrade with extremely unhelpful error message, and absolutely no indication as to what file was being processed at the time (or that this relates to a filestore file).

Workaround:
Remove the newlines at the beginning of any SSL key files that begin with a newline. During an upgrade scenario, edit the files in the filestore.


616215-2 : TMM can core when using LB::detach and TCP::notify commands in an iRule

Component: Local Traffic Manager

Symptoms:
TMM cores when running an iRule that has the LB::detach command before the TCP::notify command.

Conditions:
A virtual server with an iRule that has the LB::detach command executed before the TCP::notify command.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid the combination of the TCP::notify and LB::detach commands.

Fix:
TMM no longer cores in this instance.


616169-2 : ASM Policy Export returns HTML error file

Component: Application Security Manager

Symptoms:
When attempting to export an ASM Policy the resulting file contains an HTML error page.

Conditions:
It is not known what triggers this condition.

Impact:
Unable to export ASM Policies.

Workaround:
Delete all files in /ts/dms/policy/upload_files/. All files are transient and can safely be deleted.

Fix:
Permissions are now explicitly set on exported ASM Policies so the GUI PHP process can successfully download it.


615970-2 : SSO logging level may cause failover

Solution Article: K02319425

Component: Access Policy Manager

Symptoms:
SSO logging level may cause failover.

Conditions:
SSO logging level set to "Debug".

Impact:
TMM may crash. Core file may be generated.

Workaround:
Lower the SSO log level from "Debug" to either "Info" or "Notice".

Fix:
The SSO logging level of "Debug" no longer causes failover.


615934-2 : Overwrite flag in various iControl key/certificate management functions is ignored and might result in errors.

Component: TMOS

Symptoms:
Overwrite flag in key/certificate management iControl functions is ignored and might result in errors.

Conditions:
If there is an existing key/certificate, and the key/certificate management iControl functions are used to overwrite the key/certificate by setting the overwrite flag, the flag is ignored, and an error is returned.

Impact:
Key/certificate overwrite using iControl operations might fail.

Fix:
The fix honors the overwrite flag, so that the key/certificate is overwritten when the flag is set to true.


615260 : out of memory condition when URL categorization is configured to work with large feedlists

Component: Traffic Classification Engine

Symptoms:
out of memory condition when URL categorization is configured to work with large (millions of records) feedlists.

Conditions:
In order to hit this issue user would have to load and unload large feedlist multiple times

Impact:
SWAP memory will increase and will eventually lead the box to run out of memory

Fix:
This problem is fixed in v12.1


615187-1 : Missing hyperlink to GSLB virtual servers and servers on the pool member page.

Component: Global Traffic Manager (DNS)

Symptoms:
Hyperlinks to to GSLB virtual servers and servers on the pool member page were removed in 11.x.

Conditions:
Have a GSLB pool with pool members set up.

Impact:
Must manually note of the member's virtual or server.

Workaround:
Manually take note of virtual or server and search for it.

Fix:
Added hyperlink to GSLB virtuals and servers on the pool member page.


614891-4 : Routing table doesn't get updated when EDGE client roams among wireless networks

Component: Access Policy Manager

Symptoms:
Clients using the EDGE client report that they are unable to reach the VPN when they switch wifi networks.

Conditions:
This is triggered when a device running the EDGE client is on a wifi network, then roams to another wifi network that has a different default route.

Impact:
Clients have an incorrect route to the VPN and are forced to re-connect.


614865-2 : Overwrite flag in iControl functions key/certificate_import_from_pem functions is ignored and might result in errors.

Component: TMOS

Symptoms:
Overwrite flag in iControl functions key/certificate_import_from_pem functions is ignored and might result in errors.

Specifically, the functions are:
key_import_from_pem()
certificate_import_from_pem()
key_import_from_pem_v2()
certificate_import_from_pem_v2()

Conditions:
When there is an existing key or certificate on the BIG-IP system, and you want to overwrite them using key_import_from_pem(), certificate_import_from_pem(), key_import_from_pem_v2(), or certificate_import_from_pem_v2() iControl calls, it results in errors stating that the key or certificate already exists on the BIG-IP system.

Impact:
Cannot overwrite the key/certificate file-objects using these iControl calls.

Workaround:
There are two workarounds:
- Delete and import the key/certificate using key_import_from_pem(), certificate_import_from_pem(), key_import_from_pem_v2(), or certificate_import_from_pem_v2() iControl calls.

- Use key_import_from_file and certificate_import_from_file iControl calls as an alternative to import key/certificate from a file.

Fix:
Overwrite flag in iControl functions key/certificate_import_from_pem_v2() functions are now processed correctly and no longer produce errors.


614563-1 : AVR TPS calculation is inaccurate

Component: Advanced Firewall Manager

Symptoms:
The TPS that AVR calculates for DoS is 11% more than the real TPS.

Conditions:
DoS profile attached to the virtual server.

Impact:
Attack can wrongly be detected.

Workaround:
None.

Fix:
TPS that AVR calculates for DoS now reflects the actual TPS.


614322-3 : TMM might crash during handling of RDG-RPC connection when APM is used as RD Gateway

Solution Article: K31063537

Component: Access Policy Manager

Symptoms:
TMM might crash during handling of RDG-RPC connection when APM is used as RD Gateway.

Conditions:
RDP client uses RDG-RPC protocol to connect via APM's RD Gateway implementation.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
N/A

Fix:
Fixed TMM crash, which occurred during RDG-RPC protocol handling.


614147-3 : SOCKS proxy defect resolution

Solution Article: K02692210


613673-1 : Pool members may not be marked up and/or there might be a slight delay in monitors

Solution Article: K48693281

Component: Local Traffic Manager

Symptoms:
A UDP monitor might fail to mark a pool member up even when the pool member is up.

Other monitor types may mark a pool member down.

A slight delay (less than 0.1 seconds) might be noticed in monitor traffic sent by the BIG-IP.

Conditions:
To experience the incorrect pool member status issue, there is generally some other monitor on the system that is legitimately down.

To experience the delay, run an affected version. The issue has been observed with TCP, HTTP, and HTTPS monitors.

Impact:
Incorrect pool member status or pool member flapping.

Connections to monitored pool members might last slightly longer than necessary.

Workaround:
None.

Fix:
In this release, the system now correctly sets pool member status and connections to monitored pool members no longer last longer than necessary.


613613-1 : Incorrect handling of form that contains a tag with id=action

Component: Access Policy Manager

Symptoms:
In some cases, a form with an absolute path in the action is handled incorrectly in Internet Explorer (IE) versions 7, 8, and 9. The resulting action path is wrong and the form cannot be submitted.

Conditions:
This issue occurs under these conditions:
-- HTML Form with absolute action path.
-- A tag with id=action inside this form.
-- A submit button in the form.
-- IE versions 7 through 9.

Impact:
The impact of this issue is that the web application can not work as expected.

Workaround:
This issue has no workaround at this time.

Fix:
Forms with absolute action paths and tag with id=action inside are handled correctly.


613576-2 : QOS load balancing links display as gray

Component: Global Traffic Manager

Symptoms:
All links in all data centers appear gray. After this patch all link appear to be green and the functional of load balancing to the first available link in each pool is restored.

Conditions:
This bug only affects devices licensed after 9/1/2016 which contain the gtm_lc: disabled field.

Impact:
Any GTM/LC devices licensed after 9/1/2016 and using links as part of their configuration will have the links reported as gray.

Workaround:
Remove all ilnks from configuration or install this hotfix.


613536-2 : tmm core while running the iRule STATS:: command

Component: TMOS

Symptoms:
With an iRule that runs the STATS::set command inside the ACCESS_SESSION_CLOSED event, tmm cores.

Conditions:
STATS:: command invoked inside the ACCESS_SESSION_CLOSED event. This event does not have all of the connection information so invoking STATS:: to store data from the connection will fail and cause tmm to crash.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not use STATS::set inside ACCESS_SESSION_CLOSED


613369-1 : Half-Open TCP Connections Not Discoverable

Component: Local Traffic Manager

Symptoms:
New TCP connection requests are reset after a specific sequence of TCP packets.

Conditions:
A TCP connection in half-open state.

Impact:
Half-open TCP connections are not discoverable

Fix:
Properly acknowledge half-open TCP connections.


613225-3 : OpenSSL vulnerability CVE-2016-6306

Solution Article: K90492697


613127-6 : Linux TCP Stack vulnerability CVE-2016-5696

Solution Article: K46514822


613088-1 : pkcs11d thread has session initialization problem.

Component: Local Traffic Manager

Symptoms:
pkcs11d does not initialize, especially in the secondary slot(s). SafeNet connections cannot be established on the secondary blades.

Conditions:
This occurs when SafeNet is configured with VIPRION chassis

Impact:
When this occurs, BIG-IP is unable to establish SafeNet connections from the secondary blades.

Workaround:
None.

Fix:
Fixed a pkcs11d thread session initialization problem that prevented SafeNet connections.


613045 : Interaction between GTM and 10.x LTM results in some virtual servers marked down

Component: Global Traffic Manager

Symptoms:
Some GTM virtual servers are never marked up when interacting with 10.x LTM.

Conditions:
1. On a GTM server, with autoconf off, manually create a virtual server that is using translated IP/port and either no LTM virtual server name or an incorrect LTM virtual server name.
2. Make sure the LTM virtual server is available.

Impact:
On the GTM side, that LTM virtual server will never get marked up.

Workaround:
None.

Fix:
Interaction between GTM and 10.x LTM now works, so virtual servers are correctly marked up.


612694-3 : TCP::close with no pool member results in zombie flows

Component: Local Traffic Manager

Symptoms:
'tmsh show sys conn all-properties' shows connections whose idle time exceeds the timeout.

Conditions:
There is no pool member, and a TCP::close iRule activates (typically after a TCP::respond).

Impact:
Connection does not tear itself down.

Workaround:
Make TCP::close conditional on pool failure, and rely on the pool failure to RST the connection rather than perform a clean TCP close.

Fix:
The system now properly handles TCP teardown when TCP::close has already torn down the rest of the stack.


612419-2 : APM 11.4.1 HF10 - suspected memory leak (umem_alloc_32/network access (variable))

Component: Access Policy Manager

Symptoms:
When there are multiple network access resources, and users switch between them within the same connection, a small memory leak happens.

Conditions:
Network access; full webtop, multiple Network Access resources.

Impact:
Memory usage increases over time.

Workaround:
There is no workaround. It is a relatively slow leak though. In the case where it was observed, the leak was about 130MB per month.

Fix:
Fixed a memory leak related to network access.


612229-2 : TMM may crash if LTM a disable policy action for 'LTM Policy' is not last

Component: Local Traffic Manager

Symptoms:
TMM may crash while processing an LTM policy.

Conditions:
- VIP with LTM policy attached.
- LTM policy contains rule with 2 or more actions.
- Policy action of disable - LTMN Policy is not the last one in the list of actions.

Impact:
TMM crash with the following in one of the /var/log/tmm log files:
notice ** SIGABRT **
Traffic disrupted while tmm restarts.

Workaround:
Ensure any LTM policy disable action is the last in the list of actions.

Fix:
TMM no longer crashes if LTM a disable policy action for 'LTM Policy' is not last in the list of actions in the rule.


612128 : OpenSSH vulnerability CVE-2016-6515

Solution Article: K31510510


611968-1 : JavaScript Active content at an HTML page browsed by IE8 with significant amount of links (>1000) can run very slow

Component: Access Policy Manager

Symptoms:
JavaScript Active content at an HTML page browsed by IE8 with significant amount of links (>1000) can run very slow.

Conditions:
- IE8 only.
- Significant number of links: >1000.
- JavaScript event handlers presence.

Impact:
Web application performance slowdown.

Workaround:
None

Fix:
Fixed.


611669-1 : Mac Edge Client customization is not applied on macOS 10.12 Sierra

Component: Access Policy Manager

Symptoms:
Mac Edge Client's Icon, application name, company name, amongst other things can be customized on BIG-IP before deploying on end user's machine. But on Mac Edge Client on macOS 10.12 Sierra this customization is not applied.

Conditions:
macOS Sierra 10.12, Edge client, customization

Impact:
Mac Edge Client customization is not applied on macOS 10.12 Sierra. Functionally there should be no impact except that user will see default application visually.

Workaround:
run following command on Terminal and re-launch Edge client:

For English:
$ defaults write -globalDomain AppleLanguages -array "en" "en-US"

For German:
$ defaults write -globalDomain AppleLanguages -array "de" "de-US"

For Korean:
$ defaults write -globalDomain AppleLanguages -array "ko" "ko-US"

For Japanese
$ defaults write -globalDomain AppleLanguages -array "ja" "ja-US"

For French
$ defaults write -globalDomain AppleLanguages -array "fr" "fr-US"

For spanish
$ defaults write -globalDomain AppleLanguages -array "es" "es-US"

For Chinese traditional
$ defaults write -globalDomain AppleLanguages -array "zh-Hant" "zh-Hant-TW" "zh-Hant-US"

For Chinese simplified
$ defaults write -globalDomain AppleLanguages -array "zh-Hans" "zh-Hans-US"

Fix:
Edge client honors customization on macOS Sierra 10.12 now.


611469-2 : Traffic disrupted when malformed, signed SAML authentication request from an authenticated user is sent via SP connector

Solution Article: K95444512


611355 : tmm core with PEM

Component: Policy Enforcement Manager

Symptoms:
tmm cores intermittently on SIGSEGV.

Conditions:
A background job processing HA session information might rarely trigger this. No external factor is causing this.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
This release fixes the rarely encountered issue in which a background job processing HA session information might have triggered a tmm core.


610609-1 : Total connections in bigtop, SNMP are incorrect

Component: Local Traffic Manager

Symptoms:
While looking at total connections for the active BIG-IP using bigtop or SNMP, the connections are reported too high. For example if you sent a single connection through BIG-IP it is reported as 2 connections. Meanwhile, the standby device with mirroring configured accurately shows the number of connections.

Conditions:
This occurs on PVA-enabled hardware platforms.

Impact:
The total connection count statistic is incorrect.


610429-3 : X509::cert_fields iRule command may memory with subpubkey argument

Component: Local Traffic Manager

Symptoms:
The X509::cert_fields iRule command can leak memory in the 'method' memory subsystem if called with the 'subpubkey' argument, when the 'subpubkey' argument is not the last argument.

Conditions:
Create an iRule using X509::cert_fields where the subpubkey is not the last argument.

Example/signature to look for:
ltm rule rule_leak {
    when HTTP_REQUEST {
        if { [SSL::cert 0] ne "" } {
            HTTP::respond 200 content "[X509::cert_fields [SSL::cert 0] 0 subpubkey hash]\n"
        } else {
            HTTP::respond 200 content "no client cert (WRONG!)"
        }
    }
}

Impact:
Memory will leak, eventually impacting the operation of tmm.

Workaround:
Ensure that 'subpubkey' is the last argument to X509::cert_fields


610354-2 : TMM crash on invalid memory access to loopback interface stats object

Component: TMOS

Symptoms:
TMM can crash with segmentation fault when TMM drops packets on its internal loopback interface. TMM needs to update interface stats associated with the loopback interface when dropping packets on that interface. The interface stats object for loopback interface is not allocated yet. That results in segmentation fault.

Conditions:
TMM drops packets on its internal loopback interfaces.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
No Workaround.


610255-2 : CMI improvement

Solution Article: K62279530


610248 : IE 11 browser does not display VDI profile columns properly

Component: Access Policy Manager

Symptoms:
Microsoft Internet Explorer version 11 browsers do not properly display the two columns 'General information' and 'MSRDP settings' in the VDI profile edit window.

Conditions:
Using IE 11 browser, and APM is provisioned to use VDI profile.

Impact:
Makes it difficult to configure VDI profile using the GUI.

Workaround:
Use other browsers to configure VDI profile.

Fix:
Microsoft Internet Explorer version 11 browsers now properly display the two columns 'General information' and 'MSRDP settings' in the VDI profile edit window.


610243 : HTML5 access fails for Citrix Storefront integration mode with gateway pass through authentication

Component: Access Policy Manager

Symptoms:
HTML5 client can not be used to access the published applications or desktops.
HTML5 client access displays returns blank/black screen and displays "Can not connect to the server".

Conditions:
APM is configured Citrix Storefront integration mode. And in Storefront html5 client access is enabled.

Impact:
HTML5 client can not be used to access the published resources

Workaround:
None

Fix:
HTML5 client can be used to access the published resources.


610224-1 : APM client may fetch expired certificate when a valid and an expired certificate co-exist

Component: Access Policy Manager

Symptoms:
APM client does not consider the expiration when it matches certificates for Machine Cert Check. If a matching but expired certificate is found before a valid certificate, the expired certificate is used for Machine Cert Check on Windows.

Conditions:
A valid and an expired certificate co-exist in the certificate store.

Impact:
Machine Certificate check fails.

Workaround:
Remove the expired certificate from the store.

Fix:
When a valid and an expired certificate co-exist, the system now matches the valid certificate.


610180-3 : SAML Single Logout is misconfigured can cause a minor memory leak in SSO plugin.

Component: Access Policy Manager

Symptoms:
When BIG-IP is used as SAML SP, and SLO is not properly configured on associated saml-idp-connector objects, IdP initiated SAML SLO may result in memory leak in SSO plugin.

Conditions:
- BIG-IP is used as SP.
- Associated saml-idp-connector object has 'single-logout-uri' property configured, but 'single-logout-response-uri' property is empty.
- User performs IdP initiated SAML SLO

Impact:
SSO plugin leaks memory

Workaround:
There are two possible workarounds:
- Fix misconfiguration: Configure SLO correctly by adding value to 'single-logout-response-uri' property of IdP connector object.
- Disable SLO by removing single-logout-uri' property of IdP connector object.

Fix:
When fixed, memory will no longer leak in SSO plugin even when SLO is misconfigured.


609674-2 : machine certificate check creates issuer string with DC with reverse order

Solution Article: K38333488

Component: Access Policy Manager

Symptoms:
Machine certificate check on MAC creates issuer string with incorrect domain component (DC) order if it has any domain component in the certificate.
For example, if DC in certificate says f5net.com, issuer DC string should look like "DC=f5net, DC=com" but instead, it's in reverse order (DC="com", DC="f5net").

Conditions:
Machine certificate check configured on BIG-IP systems, certificate contains DC components.

Impact:
Machine certificate check might fail.

Workaround:
For access policies with machine certificate check targeted towards MAC, the order of DC should be reversed (compared to access policy with machine certificate check targeted towards Microsoft Windows) in the regex configured in machine certificate check.

Fix:
DC order evaluated by MAC is correctly ordered now and matches with that of Microsoft Windows.

Behavior Change:
Previously, machine certificate check on MAC creates issuer string with incorrect domain component (DC) order if it has any domain component in the certificate.
For example, if DC in certificate says f5net.com, issuer DC string should look like "DC=f5net, DC=com" but instead, it's in reverse order (DC="com", DC="f5net"). Now, DC order evaluated by MAC is correctly ordered now and matches with that of Microsoft Windows.


609496-1 : Improved diagnostics in BD config update (bd_agent) added

Component: Application Security Manager

Symptoms:
Improved diagnostics in BD config update (bd_agent) are needed.

Conditions:
Further troubleshooting of BD config update transmission is needed.

Impact:
No diagnostics are available.

Workaround:
None.

Fix:
Improved diagnostics in BD config update (bd_agent) were added.


609119-5 : Occasionally the logging system prints out a blank message: err mcpd[19114]: 01070711:3:

Component: TMOS

Symptoms:
Occasionally the logging system prints out a blank message, similar to the following example:

-- err mcpd[19114]: 01070711:3:

For this log statement, there is text associated with the error in the bigip_mcpd_error_defs.in file, so something should be logged.

Conditions:
The problem is the result of an exception handler issue in mcpd's File Object validator. The damaged logs can come from anywhere in mcpd, but appear only after a File Object configuration change fails validation. If the problem occurs, it will happen only once per validation error. The damage caused by the exception handler is automatically corrected when the system rewrites the log.

Impact:
Except for the missing log text, the state and behavior of the BIG-IP system is unaffected.

Workaround:
None. The problem corrects automatically when the system rewrites the log.

Fix:
The logging system prints out a blank message in response to failed file object configuration change validations.


609084-1 : Max number of chunks not configurable above 1000 chunks

Component: Application Security Manager

Symptoms:
If you want to support requests larger than 1000 chunks, the request is blocked and the system posts the following message in the ASM event log:

Unparsable request content Chunks number exceeds request chunks limit: 1000.

Conditions:
This occurs when the request exceeds 1000 chunks.

Impact:
Requests that are valid from the server side are being rejected.

Workaround:
None.

Fix:
This release adds an internal parameter "request_max_chunks_number" to enable configuring a greater than 1000 max number of chunks. The default value is 1000

Behavior Change:
This release adds an internal parameter "request_max_chunks_number" to enable configuring a greater than 1000 max number of chunks. The default value is 1000


608742-4 : DHCP: DHCP renew ack messages from server are getting dropped by BIGIP in Forward mode.

Component: Policy Enforcement Manager

Symptoms:
When BIGIP is configured in Forwarding mode, renewal ack message from server in response to unicast renewal message from DHCP clients is getting dropped.

Conditions:
BIG IP in forwarding mode. DHCP clients sending unicast renewal message to DHCP server

Impact:
Unicast DHCP renewal requests are not acked. DHCP clients will send broadcast renewal messages and will be acked by servers.

Workaround:
After unable to receive acks from DHCP servers for unicast DHCP renewal messages, DHCP client will send broadcast DHCP renewal messages and will be acked by DHCP server and acks forwarded by BIGIP and received by DHCP clients.


608551-4 : Half-closed congested SSL connections with unclean shutdown might stall.

Component: Local Traffic Manager

Symptoms:
Half-closed congested SSL connections with unclean shutdown might stall.

Conditions:
If SSL egress is congested and the client FINs with no Close Notify, connection might stall as SSL does not request more egress data from HTTP.

Impact:
Possible stalled flow.

Workaround:
Use SSL client that sends clean shutdown.

Fix:
Resolved half-closed congested SSL connections with unclean shutdown, so connections no longer stall.


608408-4 : TMM may restart if SSO plugin configuration initialization fails due to internal error in tmconf library

Component: Access Policy Manager

Symptoms:
TMM may restart when new SAML SSO configuration is created on BIG-IP systems as SAML IdP. This could also happen when BIG-IP is restarted, or a saved configuration containing SAML SSO objects is loaded on running BIG-IP.

Conditions:
All of the following
- The BIG-IP system is used as SAML IdP
- New SAML SSO configuration is added on BIG-IP
- Rarely occurring internal tmconf error happens when processing newly added configuration.

Impact:
TMM may restart.

Workaround:
None.

Fix:
TMM no longer restarts when internal error happens upon adding new SAML SSO configurations. Instead, the system logs the following error in /var/log/apm to indicate problematic configuration object: Internal error processing sso config <name>.


608320-4 : iControl REST API sets non-default persistence profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets persistence profile's non-default property value as "none"; properties missing in iControl REST API response

Component: TMOS

Symptoms:
For persistence profiles, iControl REST does not provide visibility for property override when "none" is specified, including references, passwords, and array of strings.

Conditions:
-- Use iControl REST API with persistence profiles.
-- string, enum, or vector of enum/string property explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf.

Impact:
The iControl REST API response skips these elements. iControl REST does not provide visibility for persistence profile property overrides.

Workaround:
None.

Fix:
iControl REST API now returns persistence profile elements (i.e., string, enum , or vector of enum/string property that is explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf) with a value "none". The exclusion to this policy is the secured attributes. Secured attributes are always excluded from the iControl REST API response.


607713-4 : SIP Parser fails header with multiple sequential separators inside quoted string.

Component: Service Provider

Symptoms:
SIP Parser fails header with multiple sequential separators inside quoted string.

Conditions:
If a SIP header contains multiple attribute separators ',' or ';' in an attribute.

Impact:
The SIP parser flags the message as an error. If this occurs in a quote within the attribute, it should be allowed, but it will still fail, Valid SIP messages are failing to be parsed.

Workaround:
None.

Fix:
The SIP parser has been improved to ignore multiple sequential separators if within quotes.


607360-2 : Safenet 6.2 library missing after upgrade

Component: Local Traffic Manager

Symptoms:
After upgrading BIG-IP, a symbolic link is missing to the core Safenet library.

Conditions:
This occurs when a BIG-IP installation with Safenet 6.2 already installed is upgraded.

Impact:
Safenet 6.2 is not functional.

Workaround:
Reinstall Safenet 6.2. Or,

run this command at all blades of BIG-IP after the installation.

ln -sf /shared/safenet/toolkit/libgem.so /usr/lib64/openssl/engines/libgem.so

Fix:
Add symbolic link to libgem at time of pkcs11d daemon start/restart.


607314-3 : Oracle Java vulnerability CVE-2016-3500, CVE-2016-3508

Solution Article: K25075696


607304-2 : TMM is killed by SOD (missing heartbeat) during geoip_reload performing munmap.

Component: Local Traffic Manager

Symptoms:
TMM is killed by SOD (missing heartbeat) during geoip_reload performing munmap.

Conditions:
This can occur under normal operation, while running the geo_update command.

Impact:
Traffic disrupted while tmm restarts.


606575-3 : Request-oriented OneConnect load balancing ends when the server returns an error status code.

Component: Local Traffic Manager

Symptoms:
Request-oriented OneConnect load balancing ends when the server returns an error status code.

Conditions:
OneConnect is enabled and the server responds with a HTTP error status code.

Impact:
The client remains connected to the server, and no further load-balancing decisions are made.

Workaround:
It may be possible to detect the HTTP status code in the response, and manually detach the client-side.

To do so, use an iRule similar to the following:

when HTTP_RESPONSE {
    if { [HTTP::status] == 200 } { return }
    if { [HTTP::status] == 401 } {
        set auth_header [string tolower [HTTP::header values "WWW-Authenticate"]]
        if { $auth_header contains "negotiate" || $auth_header contains "ntlm" } {
            # Connection-oriented auth. System should already be doing the right thing
            unset auth_header
            return
        }

        unset auth_header
    }

    catch { ONECONNECT::detach enable }
}.

Note: These workarounds should not be used when the backend server is using connection-oriented HTTP authentication (e.g., NTLM or Negotiate authentication).

Fix:
With OneConnect, the client-side remains detachable when the server-side returns an HTTP error status code.


606540-1 : DB variable changed via GUI does not sync across HA group

Solution Article: K33064211

Component: TMOS

Symptoms:
If a configuration change is made in the BIG-IP GUI which is backed by a DB variable, the change is not synced to other devices in the same sync-failover device group.
If the same db variable change is made using the Traffic Management Shell (tmsh), the db variable change will be synced to other devices in the same sync-failover device group.

Note that db variable changes are never synced to devices in sync-only device groups.

Conditions:
1. BIG-IP systems in HA group, provisioned with modules (in addition to LTM) which create their own device groups (for example, ASM).
2. Original sync-failover device group replaced by a different sync-failover device group.
3. Using the GUI to change a configuration item which is backed by a DB variable.
Examples include:
failover.standby.linkdowntime (GUI: Device Management :: Device Groups : <fodg_name> : Failover : Link Down Time on Failover )
statemirror.clustermirroring (GUI: Device Management :: Devices : <device_name> : Cluster Options )

Impact:
Configuration of devices within a sync-failover device group may not be synchronized as expected.

Workaround:
To force synchronization of a db variable change made via the GUI, use a tmsh command of the following form:

tmsh modify cm device-group <sync-failover device group name> devices modify { <device name> { set-sync-leader } }

If the sync-failover device group is not automatically synced, manually sync the device group:

tmsh run cm config-sync to-group <sync-failover device group name>


To avoid creating a db variable change that will not be synchronized across sync-failover device group members, change the configuration or db variable using tmsh:

tmsh modify sys db <variable name> value <new value>

If the sync-failover device group is not automatically synced, manually sync the device group:

tmsh run cm config-sync to-group <sync-failover device group name>

Fix:
DB variable changed via GUI now syncs across HA group as expected.


605921 : scriptd and mcpd cores following multiple failovers due to bd (asm)

Component: Application Security Manager

Symptoms:
You encounter multiple failovers due to BD (asm) failure and mcpd coring. the GUI is sluggish, then bd becomes unresponsive or mcpd cores.

Conditions:
Apply policies on a device at the same time that it becomes the Master Blade.

Impact:
A deadlock condition can occur when policies are being applied at the same time as a change arrives in the cluster config.

Workaround:
None.

Fix:
Fixed a deadlock condition when applying policies.


605865-2 : Debug TMM produces core on certain ICMP PMTUD packets

Component: Local Traffic Manager

Symptoms:
The debug TMM will produce a core on the assert "cwnd or ssthresh too low" when receiving an ICMP PMTUD packet with an MTU larger than the current MTU. This does not affect the default TMM.

Conditions:
While using the debug TMM, an ICMP PMTUD packet is received with an MTU larger than the current MTU.

Impact:
Debug TMM crashes on assert "cwnd or ssthresh too low." Traffic disrupted while tmm restarts.

Workaround:
Block incoming ICMP PMTUD packets. Note that this will cause Path MTU Discovery to fail, and IP packets sent by the BIG-IP system with the Don't Fragment (DF) bit set may be dropped silently if the MTUs of the devices on the path are configured incorrectly.

Fix:
The system now always updates TCP MSS after an ICMP PMTUD packet, so there is no debug TMM core.


605616-3 : Creating 256 Fundamental Security policies will result in an out of memory error

Solution Article: K16221342

Component: Application Security Manager

Symptoms:
ASM out of memory error will occur when 256 fundamental security policies are created.

Conditions:
Create 256 fundamental security policies.

Impact:
Out of memory error.

Workaround:
None.

Fix:
Improved memory allocations for shared XML profiles to enable more than 256 fundamental security policies.


605476-2 : istatsd can core when reading corrupt stats files.

Component: TMOS

Symptoms:
-- The istatsd process produces a core file in the /shared/core directory.

Conditions:
This issue occurs when the following condition is met:

The istatsd process attempts to read a corrupt iStats segment file with duplicate FIDs.

Under these conditions, the istatsd process continually consumes memory which produces a core causing the istatsd process to restart.

Impact:
iStatsd process will restart due to resource exhaustion.

Workaround:
To work around this issue, you can remove the iStats files and restart the istatsd processes. To do so, perform the following procedure:

Impact of workaround: This workaround will cause all statistics in the iStats files to reset.

1. Log in to the BIG-IP command line.
2. To stop the istatsd and related processes, type the following command:
tmsh stop sys service istatsd avrd merged.

3. To delete the iStats files, type the following command:
find /var/tmstat2/ -depth -type f -delete.

4. To start the istatsd and related processes, type the following command:
tmsh start sys service istatsd avrd merged.

Fix:
Added a fix to protect against a continually reading a segment file that is corrupted and has Duplicate Fids.


605427-2 : TMM may crash when adding and removing virtual servers with security log profiles

Component: Advanced Firewall Manager

Symptoms:
In certain circumstances when virtual servers are configured with security log profiles TMM may crash.

Conditions:
Creation, modification and deletion of many virtual servers with security log profiles attached.

Impact:
TMM may crash with the following log in /var/log/tmm:
<13> Apr 18 13:23:04 <hostname> notice panic: ../base/fw_log_profile.c:3368: Assertion "fw_log_profile_protocol_sip_dos ref non-zero" failed.

Traffic disrupted while tmm restarts.

Fix:
TMM no longer crashes with multiple creation, modification and deletion of many virtual servers with security log profiles attached.


604977-3 : Wrong alert when DTLS cookie size is 32

Solution Article: K08905542

Component: Local Traffic Manager

Symptoms:
When ServerSSL profile using DTLS receives a cookie with length of 32 bytes, the system reports a fatal alert.

Conditions:
Another LTM with ClientSSL profile issues 32-byte long cookie.

Impact:
DTLS with cookie size 32-byte fails.

Workaround:
None.

Fix:
DTLS now accepts cookies with a length of 32 bytes.


604931-1 : bgpd might core on restarting process with BGP debug enabled.

Solution Article: K42028295

Component: TMOS

Symptoms:
On a BIG-IP system configured with dynamic routing using the BGP routing protocol, when BGP debugging is enabled, the bgpd daemon may crash.

Conditions:
- BGP configured and peering established.
- BGP debugging enabled.
- BGP process is restarted gracefully.

Impact:
bgpd may crash.

Workaround:
Disable BGP debug.

Fix:
The bgpd might core on restarting process with BGP debug enabled.


604923-3 : REST id for Signatures change after update

Component: Application Security Manager

Symptoms:
The REST id of existing signatures are unexpectedly modified after updating a User Defined Signature, or downloading an Attack Signature Update that modifies existing signatures.

Conditions:
A User-Defined Signature is updated, or an ASU containing updated signatures is downloaded.

Impact:
The REST id of the modified signatures is changed which may confuse REST clients.

Workaround:
Execution of the following script will repair an affected device:

perl -MF5::Utils::Rest -MF5::DbUtils -MF5::ASMConfig::Entity::Signature -e '$dbh = F5::DbUtils::get_dbh(); $dbh->begin_work(); $dbh->do("UPDATE PLC.NEGSIG_SIGNATURES SET rest_uuid = \"\" "); F5::Utils::Rest::populate_uuids(dbh => $dbh, rest_entities => ["F5::ASMConfig::Entity::Signature"]); $dbh->commit();'

Fix:
Updated Signatures now retain the correct REST id.


604767-4 : Importing SAML IdP's metadata on BIG-IP as SP may result in not complete configuration of IdP connector object.

Component: Access Policy Manager

Symptoms:
When importing SAML IdP's metadata, certificate object might not be assigned as 'idp-certificate' value of saml-idp-connector object.

Conditions:
BIG-IP is used as SAML SP.

Impact:
Described behavior will result in misconfiguration. SAML WebSSO will subsequently fail.

Workaround:
Manually assign imported certificate as a 'idp-certificate' value of saml-idp-connector object.


604496-2 : SQL (Oracle) monitor daemon might hang.

Component: Local Traffic Manager

Symptoms:
SQL (Oracle) monitor daemon might hang with high monitoring load (hundreds of monitors). DBDaemon debug log contains messages indicating hung connection aborting and that the address in use, unable to connect.

Conditions:
High number of SQL (Oracle, MSSQL, MySQL, PostgresSQL) monitors. Slow SQL responses might make the condition worse.

Impact:
Flapping pool members connected to SQL monitors. Frequent aborts and restarts of SQL monitor daemon.

Workaround:
You can mitigate this issue in the following ways:
-- Reduce number of monitored pool members.
-- Reduce frequency of monitor interval.
-- Split monitors among multiple devices.
-- Run monitors on bladed systems.

Fix:
This release fixes the address-in-use issue, and contains multiple monitor improvements to handle aborts and restarts of the SQL monitor daemon as well so that the system handles hung connections without aborting.


604442-1 : iControl log

Solution Article: K12685114


604223-1 : pkcs11d signal handler improvement to turn off all threads at time of "SIGTERM"

Component: Local Traffic Manager

Symptoms:
The current signal handler use 'exit' at time of 'SIGTERM'. This may result in a core under some abnormal situations.

Conditions:
When stopping pkcs11d using command like 'bigstart restart pkcs11d' or 'kill pkcs11d'.

Impact:
pkcs11d cores.

Workaround:
pkcs11d automatically comes up again after the core.

Fix:
The system now waits for all threads to finish before the pkcs11d program exits, so the core no longer occurs.


603945-1 : BD config update should be considered as config addition in case of update failure

Component: Application Security Manager

Symptoms:
A configuration update fails when the system cannot find the item to update. Configuration failures are shown in bd.log.

Conditions:
The condition that leads to this scenario is not clear and is still under investigation.

Impact:
The update fails and the entity is not added.

Workaround:
Delete the faulty entity and re-add, and then issue the following command: restart asm.

This fixes the issue in the cases in which it is a single entity.

Fix:
A configuration update no longer fails when the system cannot find the item to update. Now, the system adds the item with its updated value if the entity does not already exist. Otherwise, the operation updates the value of the existing entry.


603667-3 : TMM may leak or corrupt memory when configuration changes occur with plugins in use

Component: Local Traffic Manager

Symptoms:
TMM may leak memory when plugins are in use and the plugin is re-initialized (typically due to configuration changes). In rare cases, memory corruption may occur causing TMM to restart.

Conditions:
Plugin-based functionality configured (ASM, APM, etc.) and configuration changes occur.

Impact:
The memory leakage generally occurs infrequently and at a rate that TMM operations are not affected. However, when memory corruption occurs, a traffic interruption may occur due to TMM restarting.

Workaround:
No workaround except disabling plugin-based functionality (such as ASM, APM, etc.).

Fix:
TMM now properly manages plugin memory, and no longer leaks or corrupts this memory.


603606 : tmm core

Component: Local Traffic Manager

Symptoms:
A tmm core occurrs with the following log message: notice panic: ../kern/page_alloc.c:521: Assertion "vmem_hashlist_remove not found" failed.

Conditions:
It is not known exactly what triggers this condition.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.


603598-2 : big3d memory under extreme load conditions

Component: Global Traffic Manager

Symptoms:
big3d memory consumption can grow if big3d is unable to process monitor requests in a timely fashion.

This can be seen by monitoring the memory consumption of big3d using standard OS tools such as top.

Conditions:
big3d maintains a queue for monitor requests.
Incoming monitor requests are first placed in the Pending queue.
Requests are moved from the Pending queue to the Active queue, if there is room in the Active queue.

When the Pending queue is full, there is no room for the Monitor Request. big3d attempts to clean up the Monitor request, but fails to completely free the memory.
This might result in a significant memory leak.

For this to happen, the Active queue must be full as well as the Pending queue.

One possible condition that might cause this is if multiple Monitors time out. This results in Monitors having long life times, which keeps the Active queue full.

Thus the Pending queue might become full and the memory leak can occur.

In BIG-IP 11.1.0 versions of big3d,
the Active queue has 256 slots and
the Pending queue has 4096 slots.

In BIG-IP 11.1.0-hf3, the queue sizes were expanded to
2048 for the Active queue and 16384 for the Pending queue.

Since the queues were smaller n versions prior to
11.1.0-hf3, this leaks is more likely to manifest itself.

In later versions, the leak is still possible, but is less likely to occur.

Impact:
big3d memory consumption grows unbounded. This might result in a big3d restart or memory starvation of other processes.

Workaround:
This can be partially mitigated by ensuring that monitors
settings are reasonable and that big3d is not overloaded.

This will minimize the chances that the Pending queue
does not become full.

There is no mechanism to resize the queues.

Fix:
When a monitor request is unable to be placed in the queue, the memory for the request is freed properly.


603479-1 : "ASM starting" while it's already running, causing the restart of all ASM daemons

Component: Application Security Manager

Symptoms:
ASM daemons suddenly restart, w/ the message "ASM Starting" in '/var/log/asm', while ASM is already running and without ASM stopping first.

Conditions:
Unknown

Impact:
ASM daemons restart

Workaround:
N/A

Fix:
We have prevented the ASM start script from being executed if it is already running.
Thus, preventing the possibility of a spurious ASM Start while it's already running.


603293-3 : Incorrect handling of L4 Dynamic ACL when it is processed together with L7 ACLs

Component: Access Policy Manager

Symptoms:
L4 Dynamic ACL is not applied to incoming traffic when assigned in combination with L7 ACL.

Conditions:
APM supports a combination of L7 ACL and L4 ACL to be assigned to one session. When L7 ACLs are assigned with higher priority than L4 ACLs, the processing of L4 ACLs is automatically deferred until L7 information is available. The issue here is that when none of L7 ACLs with higher priority match with the traffic, L4 ACL is incorrectly marked to be applied only to HTTP traffic. Therefore if the incoming traffic is not HTTP, for example, HTTPS, then this particular dynamic L4 ACL is bypassed.

Impact:
L4 Dynamic ACL is not applied correctly.

Workaround:
Reorder L4 ACLs with higher priority than L7 ACLs, if possible, or to prevent the issue from occurring, avoid assigning L7 ACLs if not needed.

Fix:
When L7 ACL is assigned in combination to L4 Dynamic ACL, L4 Dynamic ACL is correctly applied to all kinds of traffic, not only HTTP traffic.


603236-2 : 1024 and 4096 size key creation issue with SafeNet 6.2 with 6.10.9 firmware

Component: Local Traffic Manager

Symptoms:
Creating 1024 and 4096 size keys fail when the SafeNet client version installed on BIG-IP is 6.2 and SafeNet appliance firmware is 6.10.9.

Conditions:
-- SafeNet appliance: 6.2.
-- SafeNet client: 6.2.
-- SafeNet firmware: 6.10.9.

Impact:
Cannot create 1024 or 4096 size RSA keys.

Workaround:
None.

Fix:
Removed the config line, RSAKeyGenMechRemap = 1, that was conflicting with 6.10.9 firmware.


603149-1 : Large ike-phase2-lifetime-kilobytes values in racoon ipsec-policy

Component: TMOS

Symptoms:
Setting max data limit transmitted (in kilobytes) to a very large limit results in a smaller limit, causing SAs to expire too quickly. Values for ike-phase2-lifetime-kilobytes inside ipsec-policy can reach 2^32-1 kilobytes, but will be processed incorrectly, as if the value were smaller.

Conditions:
When lifetime-kilobytes is large enough, it can act as though it were smaller.

Impact:
Negotiated SAs expire too quickly when size lifetime is calculated too small.

Workaround:
Before the fix, decrease lifetime-kilobytes until properly stable.

Fix:
The fix should make every value no more than 4294967295 kilobytes work correctly, without becoming some smaller value. (Note this value is 2^32-1.) If the size of ike-phase2-lifetime-kilobytes becomes 64-bit in the future, this will also work, causing a 64-bit value for kilobytes to occur in isakmp negotiation.


603082-2 : Ephemeral pool members are getting deleted/created over and over again.

Component: Local Traffic Manager

Symptoms:
When fqdn nodes are configured, you may see ephemeral pool members getting created and deleted continuously. In severe cases, this can cause mcpd to run out of memory and crash.

Conditions:
It is not known exactly what triggers this condition, but it has been observed after running bigstart restart in a configuration containing many fqdn nodes.

Impact:
Traffic disrupted while mcpd restarts.


603071-1 : XHTML validation fails on obfuscated JavaScript

Component: Application Security Manager

Symptoms:
The obfuscated JavaScript injected by ASM for CSRF protection and other features causes web pages to fail w3c validation.

Conditions:
CSRF or WebScrapping enabled in ASM policy

Impact:
Threre is no end user impact, but if checking the page with w3c online validator it returns errors

Workaround:
N/A

Fix:
Wrapped the script in CDATA - the validator will not complain on errors.


603032-2 : clientssl profiles with sni-default enabled may leak X509 objects

Component: Local Traffic Manager

Symptoms:
SSL memory consumption grows when virtuals with sni-default-enabled clientssl profiles are modified.

Conditions:
clientssl profile with sni-default enabled combined with configuration manipulations of virtuals with such profiles.

Impact:
The amount of leakage will depending on the number of virtuals with sni-default-enabled clientssl profiles and frequency of configuration manipulations. For large configurations, the leakage can be very noticeable over time.

Workaround:
No workaround short of not using sni-default.

Fix:
SSL now handles sni-default-enabled clientssl profiles without leaking the X509 objects.


602654-3 : TMM crash when using AVR lookups

Component: Application Visibility and Reporting

Symptoms:
When trying to find/insert data into AVR lookups TMM/AVR core might occur.

Conditions:
AVR lookups in use.

Impact:
tmm crashes. The crash occur when two processes simultaneously try to access the same cell in the lookup. Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
TMM no longer crashes when using AVR lookups.


602366-2 : Safenet 6.2 HA performance

Component: Local Traffic Manager

Symptoms:
With Safenet 6.2 HA setup, you only sees the performance of one HSM.

Conditions:
Safenet 6.2 client is installed and Safenet HA is used.

Impact:
Only one HSM is used for the HA setup.

Workaround:
Add primary hsm to the newly created ha group
/shared/safenet/lunasa/bin/lunacm -c hagroup createGroup -serialNumber 464683014 -label ha_test -password <pw>

or
echo "copy" | /shared/safenet/lunasa/bin/lunacm -c hagroup createGroup -serialNumber 464683014 -label ha_test -password <pw>

Add following hsm to the ha group
/shared/safenet/lunasa/bin/lunacm -c hagroup addMember -serialNumber 470379014 -group ha_test -password <pw>

Enable HAonly
/shared/safenet/lunasa/bin/lunacm -c hagroup HAOnly -enable

Delete ha group
/shared/safenet/lunasa/bin/lunacm -c hagroup deleteGroup -label ha_test

Fix:
Installation script is updated for Safenet 6.2 HA.


602358-2 : BIG-IP ServerSSL connection may reset during rengotiation with some SSL/TLS servers due to ClientHello version

Component: Local Traffic Manager

Symptoms:
During SSL/TLS renegotiation, the TLS standard requires that the new ClientHello version matches the first session.

Usually, SSL/TLS servers require the new ClientHello version to match the previous negotiated (ServerHello) version. The BIG-IP ServerSSL default behavior is to match this requirement.

The problem occurs if the SSL/TLS server requires the ClientHello (both in the Record layer and Handshake Protocol) in the new ClientHello to be exactly the same as the SSL/TLS version of the first ClientHello; that is:
************************************************************
1st ClientHello record layer version == 2nd ClientHello record layer version;
1st ClientHello Handshake Protocol version == 2nd ClientHello Handshake Protocol version.
************************************************************
As a result, the SSL/TLS server will reject the renegotiation handshake, causing the connection to terminate.

Conditions:
This occurs when using virtual servers configured with one or more ServerSSL profiles, and an SSL/TLS renegotiation occurs, and the server requires the new ClientHello version to match the first ClientHello instead of the previous ServerHello version.

Impact:
SSL/TLS renegotiation between BIG-IP ServerSSL profile and server may fail, resulting in an unexpected connection close or reset.

Workaround:
Manually setting the ciphers in the ServerSSL to TLS1.0 can solve the issue.

Fix:
A new db variable called ssl.RenegotiateWithInitialClientHello has been added to control the SSL/TLS version in the 2nd ClientHello:

1. The default is disable, which means that the 2nd ClientHello SSL/TLS version will be set to the negotiated version in the 1st round ServerHello.

2. If it is set to enable, both ClientHello versions will be exactly the same.


602221-3 : Wrong parsing of redirect Domain

Component: Application Security Manager

Symptoms:
ASM learns wrong domain names

Conditions:
no '/' after domain name in the redirect domain

Impact:
wrong learning suggestion can lead to wrong policy

Workaround:
N/A

Fix:
Fixing an issue with parsing the URL in the location header


601938-3 : MCPD stores certain data incorrectly

Solution Article: K52180214


601927-3 : Security hardening of control plane

Solution Article: K52180214

Component: TMOS

Symptoms:
File permissions changes needed as found by internal testing

Conditions:
N/A

Impact:
N/A

Fix:
Apply latest security practices to control plane files.


601905-4 : POST requests may not be forwarded to backend server when EAM plugin is enabled on the virtual server

Component: Access Policy Manager

Symptoms:
POST requests appear to hang when they are sent through a virtual server with EAM plugin enabled.

Conditions:
Most likely, the POST request contains large post data.

Impact:
The POST request will fail.

Workaround:
The following iRule will workaround the issue:

 when HTTP_REQUEST {

  if {[HTTP::method] eq "POST"}{
    # Trigger collection for up to $max_collect of data
    set max_collect 1000000
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= $max_collect}{
      set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length $max_collect
    }
    # Check if $content_length is not set to 0
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
  }


601527-3 : mcpd memory leak and core

Component: TMOS

Symptoms:
Mcpd can leak memory during config update or config sync.

Conditions:
All of the conditions that trigger this are not known but it seems to occur during full configuration sync and is most severe on the config sync peers. It was triggered making a single change on the primary by configuring a monitor rule, e.g., tmsh create ltm pool p members { 1.2.3.4:80 } monitor http

Impact:
Loss of memory over time, which may result in out-of-memory and mcpd core.

Fix:
Fixed a memory lean in mcpd


601502-1 : Excessive OCSP traffic

Component: TMOS

Symptoms:
With OCSP configured on a virtual server, you see excessive OCSP requests going to the OCSP server.

Conditions:
Virtual server configured with an OCSP profile

Impact:
OCSP responses are not cached properly and excessive requests are sent to the server.

Workaround:
None.

Fix:
OCSP responses are now cached properly, so excessive requests are no longer sent to the server.


601496-1 : iRules and OCSP Stapling

Component: Local Traffic Manager

Symptoms:
Using certain iRules on virtual servers with OCSP Stapling enabled on the Client SSL profile might cause OCSP requests to be reissued, resulting in a memory leak.

You may notice warning messages similar to the following in /var/log/ltm:
warning tmm[11300]: 011e0003:4: Aggressive mode sweeper: /Common/default-eviction-policy (0) (global memory) 115 Connections killed.

Conditions:
This occurs when the following conditions are met:
-- Virtual server with OCSP Stabling enabled.
-- iRule attached to the virtual server that uses SSL::renegotiate.

Impact:
TMM memory used increases gradually, eventually the aggressive mode sweeper is activated.

Workaround:
None.

Fix:
Using certain iRules on virtual servers with OCSP Stapling enabled on the Client SSL profile no longer causes OCSP requests to be reissued, so there is no associated memory leak.


601420-2 : Possible SAML authentication loop with IE and multi-domain SSO.

Component: Access Policy Manager

Symptoms:
When APM is configured with SAML authentication and multi-domain SSO, Internet Explorer may encounter authentication loop and never complete the access policy.

Conditions:
APM is configured with SAML authentication and multi-domain SSO.

Impact:
Using Internet Explorer, the client may not be unable to connect to its desired destination.

Workaround:
Chrome and Firefox do not seem to be affected.

Fix:
Use cookie for session for multi-domain if TOKEN lookup fails. Previously, the cookie was ignored for multi-domain response URI. However, with the introduction of TOKEN based session lookup, this causes a failure if the client retries the request (since the TOKEN was consumed in the request prior to the retry).


601255-3 : RTSP response to SETUP request has incorrect client_port attribute

Component: Service Provider

Symptoms:
- Clientside data is sent to UDP port 0
- RTSP response to SETUP request contains incorrect 'client_port' attribute (0)

Conditions:
- Virtual with RTSP profile.
- 200/OK is received from server in response to the initial SETUP request
- SETUP request was the initial message received on a new connection

Impact:
Unicast media may forwarded to incorrect UDP port (0).

Fix:
Initialize 'client_port' attribute to value received from server when re-writing response to client.


601180-1 : Link Controller base license does not allow DNS namespace iRule commands.

Solution Article: K73505027

Component: Global Traffic Manager

Symptoms:
The Link Controller base license improperly prevents DNS namespace iRule commands.

Conditions:
A Link Controller license without an add-on that allows Layer 7 iRule commands.

Impact:
An administrator cannot add DNS namespace commands to an iRule. Cannot upgrade from a pre-11.5 configuration, where the commands were working, to 11.5.4 through 12.1.2.

Workaround:
To enable upgrade, remove DNS namespace commands from the configuration prior to upgrade.

Fix:
DNS namespace iRule commands are now properly accepted with a Link Controller base license.


601178-3 : HTTP cookie persistence 'preferred' encryption

Component: Local Traffic Manager

Symptoms:
When encryption is 'preferred' in the http cookie persistence profile, when the client presents a plain-text route domain formatted cookie the BIG-IP will ignore the cookie and re-load balance the connection.

Conditions:
This occurs when route-domain-compatible cookies are sent in plaintext.

Impact:
Cookie does not get accepted by the persistence profile and flow does not persist.


600982-1 : TMM crashes at ssl_cache_sid() with "prf->cache.sid == 0"

Component: Local Traffic Manager

Symptoms:
When SSL is configured, the TMM might rarely crash, logging the following error in /var/log/ltm: notice panic: ../modules/hudfilter/ssl/ssl_session.c:538: Assertion "cached" failed.

Conditions:
No conditions to be set, however this is a very rare occurrence in which a random number generator can technically generate the number Zero ( 0 ) which would trigger this.

Impact:
Traffic disrupted while TMM restarts, and failover occurs if high availability is configured. Mirroring and LB may be lost with renegotiation for certain types of traffic.

Workaround:
None.

Fix:
When SSL is configured, the TMM no longer intermittently crashes with the message: Assertion "cached" failed.


600827-5 : Stuck nitrox crypto queue can erroneously be reported

Component: Local Traffic Manager

Symptoms:
In some cases, a stuck crypto queue can be erroneously detected on Nitrox systems (Nitrox PX and Nitrox 3). When the tmm/crypto stats are examined, they show no queued requests. The message "Hardware Error(Co-Processor): n3-crypto0 request queue stuck" will appear in the ltm log file.

Conditions:
Nitrox based system performing SSL under heavy load.

Impact:
Device errors reported in logs and crypto HA action is taken, possibly resulting in failing over.

Fix:
The Nitrox crypto driver uses a proper timeout value for crypto requests.


600662-4 : NAT64 vulnerability CVE-2016-5745

Solution Article: K64743453


600593-4 : Use of HTTP Explicit Proxy and OneConnect can lead to an issue with CONNECT HTTP requests

Component: Local Traffic Manager

Symptoms:
After a CONNECT request is sent to the BIG-IP system and processed, if the client disconnects before a response is received from the server, the FIN is not propagated to the server-side and that connection remains open. If a client sends another CONNECT request to the same destination, the previous server-side flow is reused for the new request. Inspection of packet captures reveals that the BIG-IP system does not process the new CONNECT request as such, but instead forwards it to the server using the old server-side flow. This behaviour is incorrect. The CONNECT method should disable connection reuse, and the BIG-IP should close the server-side flow if the client disconnects first.

Conditions:
Use of HTTP Explicit Proxy and OneConnect together. CONNECT requests must arrive to the virtual server. The client must disconnect before the server responds.

Impact:
Some connections may fail. Depending on what data is sent to the server over an unintended connection, unpredictable results may be experienced.

Workaround:
You can apply the following iRule to the HTTP Explicit Proxy virtual server to mitigate the issue:

when HTTP_PROXY_REQUEST {
   if { [HTTP::method] equals "CONNECT" } {
      ONECONNECT::reuse disable
   }
   else {
      ONECONNECT::reuse enable
   }
}


600558-3 : Errors logged after deleting user in GUI

Component: TMOS

Symptoms:
After deleting a user in the BIG-IP GUI (under Access Policy :: Local User DB : Manage Users), the following symptoms may be observed:

1. After approximately 10 minutes, an error similar to the following appears in the LTM log (/var/log/ltm):

mcpd[25939]: 01070418:5: connection 0x5dde19c8 (user admin) was closed with active requests

This message may also appear in /var/log/webui.log and /var/log/tomcat/catalina.out.

2. After clicking Refresh, the GUI may not show the correct web page.

Conditions:
This has been reported most frequently when deleting local users (Access Policy :: Local User DB : Manage Users), but has been encountered in other ways. The issue might require deleting a user and then remaining on the Manage Users page until an internal timeout of approximately 10 minutes passes.

Impact:
Error messages logged.
GUI may not show the correct web page.

Workaround:
Use the CLI (tmsh) to delete local users.

Fix:
Errors are no longer logged after deleting user in GUI.


600535 : TMM may core while exiting if MCPD connection was previously aborted

Component: Local Traffic Manager

Symptoms:
TMM cores while exiting after MCPD has spontaneously restarted.

Conditions:
MCPD aborts connection to TMM, typically due to fatal internal configuration errors causing MCPD to exit. This is generally a rarely occurring issue.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
This issue has no workaround at this time.

Fix:
TMM no longer cores when exiting.


600232-4 : OpenSSL vulnerability CVE-2016-2177

Solution Article: K23873366


600223-4 : OpenSSL vulnerability CVE-2016-2177

Solution Article: K23873366


600205-4 : OpenSSL Vulnerability: CVE-2016-2178

Solution Article: K53084033


600198-4 : OpenSSL vulnerability CVE-2016-2178

Solution Article: K53084033


600174-1 : Wildcard "*" redirection domain cannot be deleted if list is scrollable

Component: Application Security Manager

Symptoms:
Wildcard "*" redirection domain cannot be deleted if list is scrollable

Conditions:
Add redirection domains until list becomes scrollable (at least 4 or 5)

Impact:
first redirection domain in the list cannot be deleted

Workaround:
first delete redirection domains (not first one) to make list not scrollable, then re-add again

Fix:
Any redirection domain can be removed from the list


600116-1 : DNS resolution request may take a long time in some cases

Component: Access Policy Manager

Symptoms:
DNS resolution may appear slow in some cases

Conditions:
All of following conditions should be met

1) DNS Relay proxy is installed on user's machine
2) User's machine has multiple network adapters and some of them are in disconnected state.

Impact:
DNS resolution will be slow

Workaround:
Disable network adapters that are not connected.

Fix:
Now DNS Relay proxy server doesn't proxy DNS servers on non-connected interfaces. This fixes slow resolution DNS issue.


600069-3 : Portal Access: Requests handled incorrectly

Component: Access Policy Manager

Symptoms:
In some cases Portal Access requests do not return the intended resource.

Conditions:
Portal Access configured

Impact:
In some cases Portal Access requests do not return the intended resource.

Fix:
Improve Portal Access request processing


599536-2 : IPsec peer with wildcard selector brings up wrong phase2 SAs

Component: TMOS

Symptoms:
If a remote IPsec peer sends a wildcard (0.0.0.0/0 <-> 0.0.0.0/0) traffic-selector in phase2, the BIG-IP system will find a match against a non-wildcard selector and use that policy to complete phase2 negotiation.

You may encounter this problem if you have one or more remote peers attempting to negotiate phase2 with wildcard traffic-selectors. An IPsec tunnel may start but fail to pass data and at the same time another IPsec tunnel may stop working.

Conditions:
The remote IPsec peer sends a wildcard (0.0.0.0/0 <-> 0.0.0.0/0) traffic-selector in phase2. Phase1 must be established first.

Impact:
A tunnel will start, but data communication (over ESP or AH) will fail.
Other tunnels may be subject to an accidental DOS when a peer establishes phase1 but uses wildcard traffic-selectors in phase2. A traffic-selector matched by wildcard might be bound to a tunnel already in use, which is then taken offline by the new Security Associations.

Fix:
Ensure that phase2 negotiation using a wildcard (0.0.0.0/0 <-> 0.0.0.0/0) traffic-selector does not establish a Security Association with an ipsec-policy associated with a non-wildcard traffic-selector.

Behavior Change:
Previously, a wildcard selector was able to match a non-wildcard selector, and thus engage the wrong (IPsec) tunnel to attempt negotiation, usually failing.

In effect, a wildcard selector was able to bind to the wrong peer; but after this change only the right peer should bind. This cleans up behavior of selector as identity key, and prevents subjecting random wrong peers from noise.


599521-2 : Persistence entries not added if message is routed via an iRule

Component: Service Provider

Symptoms:
MRF SIP route table implementation does not add a persistence entry if the message was routed via an iRule.

Conditions:
If the message is routed via an iRule, a SIP persistence entry will not be created.

Impact:
Since MRF SIP persistence may be bidirectional, not having the persistence entry will keep message flowing in the opposite direction from being automatically routed via persistence.

Workaround:
An iRule could be used to route messages directed towards the original client.

Fix:
MRF SIP will add a persistence entry for message routed via an iRule.


599285-4 : PHP vulnerabilities CVE-2016-5094 and CVE-2016-5095

Solution Article: K51390683


599168-4 : BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700

Solution Article: K35520031


598983-4 : BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700

Solution Article: K35520031


598981-2 : APM ACL does not get enforced all the time under certain conditions

Solution Article: K06913155

Component: Access Policy Manager

Symptoms:
APM ACL does not get enforced all the time under certain conditions

Conditions:
The following conditions individually increase the chances for this problem to occur:
1. The device is very busy. (Construction of ACL windows is prolonged.)
2. Concentration of connections into one TMM. (e.g., VPN feature.)
3. Small number of TMMs (e.g., BIG-IP low-end platform, Virtual Edition (VE) configurations.)
4. Application starts with a high number of concurrent connections.

Impact:
ACL is not applied for subsequent connections for that TMM. This issue does not consistently reproduce.

Workaround:
Mitigation:
Administrator can kill the affected session, which forces the user to re-login, and ultimately restarts the ACL construction process.

Fix:
Switching context when applying ACL is properly processed, and no longer cause ACL to be not enforced.


598909-1 : SQL produces errors. AVR does not display any statistics.

Component: Application Visibility and Reporting

Symptoms:
SQL produces errors. AVR does not display any statistics. AFM, APM, ASM, AVR, FPS and SWG might be non-functional.

Conditions:
In version 11.6.0 and 11.6.1, there is an issue that occurs intermittently during software build operations.

Impact:
SQL produces errors. AVR does not display any statistics.

Workaround:
If occurs:
1. Edit file /var/avr/avr_srv_code.sql.
2. Make sure that the following text starts in a new line:
   '# Old tables (for DB upgrade only)'
3. touch /var/avr/init_avrdb.
4. Restart the Monpd daemon: bigstart restart monpd.

Fix:
SQL no longer produces errors in response to an intermittent issue that occurred during software build operations.


598874-3 : GTM Resolver sends FIN after SYN retransmission timeout

Component: Local Traffic Manager

Symptoms:
If a DNS server is not responding to TCP SYN, GTM Resolver sends a FIN after a retransmission timeout (RTO) of the SYN.

Conditions:
GTM Resolver tries to open a TCP connection to a server that does not respond.

Impact:
Firewalls may log the FIN as a possible attack.

Fix:
Do not send anything in response to a SYN retransmission timeout.


598854-1 : sipdb tool incorrectly displays persistence records without a pool name

Component: Service Provider

Symptoms:
MRF SIP persistence records added for a forwarding route (a peer object without a pool), will not be displayed properly by sipdb

Conditions:
If a persistence record is added for a route that does not contain a pool, this persistence entry will not be displayed correctly.

Impact:
The persistence entry is correctly stored in the persistence table and will operate correctly. Due to the bug in the sipdb tool, this entry will not be viewable for debugging purposes.

Fix:
The fix corrects the sipdb tool so that entries which do not have a pool name will display correctly.


598498-4 : Cannot remove Self IP when an unrelated static ARP entry exists.

Component: TMOS

Symptoms:
Cannot remove a self-IP when an unrelated static ARP entry exists. The system produces an error similar to the following: err mcpd[6743]: 01071907:3: Cannot delete IP <addr> because it would leave a static neighbor (ARP/NDP) entry unreachable.

Conditions:
Static arp entry exists, and there are no Self IP addresses on the same subnet as the static ARP entry. When in this condition, none of the Self IP addresses can be deleted.

Impact:
Must delete static ARP entries in order to delete Self IP addresses.

Workaround:
None.

Fix:
In this release, you can delete Self IP addresses if unrelated static ARP entries exist.


598211-2 : Citrix Android Receiver 3.9 does not work through APM in StoreFront integration mode.

Component: Access Policy Manager

Symptoms:
During the logon to Citrix StoreFront through an APM virtual server, after the login page, the BIG-IP system sends the client the following error: Error 404 file or directory not found.

Conditions:
This occurs when the following conditions are met:
- Citrix Android receiver 3.9.
- APM is in integration mode with Citrix StoreFront.
- Storefront unified experience mode is enabled.

Impact:
Cannot access Citrix StoreFront unified UI through Android Receiver 3.9.

Workaround:
For StoreFront integration mode, there is an iRule that is created by the iApp that redirects the root page to the store's URI. The workaround is to add an additional redirect for the receiver_uri ending with receiver.html. The iRule below contains this workaround.
It is also recommended to delete and recreate the existing store account.

when HTTP_REQUEST {
    if { [regexp -nocase {/citrix/(.+)/receiver\.html} [HTTP::path] dummy store_name] } {
        log -noname accesscontrol.local1.debug "01490000:7: setting http path to /Citrix/$store_name/"
        HTTP::path "/Citrix/$store_name/"
    }
}

Fix:
Citrix Android Receiver 3.9 now works through APM in StoreFront integration mode.


598039-3 : MCP memory may leak when performing a wildcard query

Component: TMOS

Symptoms:
MCP's umem_alloc_80 cache (visible using tmctl -a) increases in size after certain wildcard queries. Accordingly, the MCP process shows increased memory usage.

Conditions:
Folders must be in use, and the user must execute a wildcard query for objects that are in the upper levels of the folder hierarchy (i.e. not at the very bottom of the folder tree).

Impact:
MCP loses available memory with each query. MCP could eventually run out of memory and core, resulting in an outage or failover (depending on whether or not the customer is running in a device cluster).

Workaround:
Do not perform wildcard queries.

Fix:
Stopped MCP leaking when wildcard queries are performed.


598002-3 : OpenSSL vulnerability CVE-2016-2178

Solution Article: K53084033


597978-4 : GARPs may be transmitted by active going offline

Component: Local Traffic Manager

Symptoms:
GARPs may be transmitted by the active when going offline. As the standby which takes over for the active will also transmit GARPs, it is not expected that this will cause impact.

Conditions:
Multiple traffic-groups configured and active goes offline.

Impact:
It is not expected that this will cause any impact.

Workaround:
Make the unit standby before forcing offline.


597966 : ARP/neighbor cache nexthop object can be freed while still referenced by another structure

Component: Local Traffic Manager

Symptoms:
Use after free or double-free of the nexthop object may cause memory corruption or TMM core.

Conditions:
This can happen if the server-side connection establishment takes some time to complete, creating a large enough time window where the nexthop object might be freed.

Impact:
The BIG-IP dataplane might crash. This is a very timing/memory-usage-dependent issue.

Workaround:
None.

Fix:
Management of nexthop object reference counting is more consistent.


597835-1 : Branch parameter in inserted VIA header not consistent as per spec

Component: Service Provider

Symptoms:
MRF SIP in LoadBalancing Operation Mode inserts a VIA header to SIP request messages. This VIA header is removed from the returned response message. The VIA header contains encrypted routing information to route the response message. The SIP spec states that all messages in the same transaction should contain the same branch header. The code used to encrypt the branch field returns a different value each time.

Conditions:
Enabling SIP Via header insertion on the BIGIP on SIP MRF profile and need to cancel an INVITE

Impact:
Some servers have code to verify the brach fields in the VIA header do not change within a transaction. These servers complain when they see the fields change.

Fix:
The code has been improved to ensure the branch field in the via header does not change.


597729-1 : Errors logged after deleting user in GUI

Component: TMOS

Symptoms:
After deleting a user in the BIG-IP GUI (under Access Policy :: Local User DB : Manage Users), the following symptoms may potentially be observed:

1. After approximately 10 minutes, an error similar to the following may appear in the LTM log (/var/log/ltm):

mcpd[25939]: 01070418:5: connection 0x5dde19c8 (user admin) was closed with active requests

Such message may also appear in /var/log/webui.log and /var/log/tomcat/catalina.out.

2. After clicking Refresh, the GUI may not show the correct web page.

Conditions:
It is possible that this error could be encountered when deleting local users (Access Policy :: Local User DB : Manage Users), and may theoretically be encountered in other ways. The issue might require deleting a user and then remaining on the Manage Users page until an internal timeout of approximately 10 minutes passes.

Impact:
Error messages logged.
GUI may not show the correct web page.

Workaround:
Use the CLI (tmsh) to delete local users.


597601-4 : Improvement for a previous issue regressed NAT-T

Component: TMOS

Symptoms:
An earlier improvement request regressed NAT-T whereby phase2 cannot establish.

Conditions:
Using NAT-T with IKEv1.

Impact:
NAT-T does not work.

Fix:
NAT-T is now working after fixing the issue introduced in the improvement.


597431-4 : VPN establishment may fail when computer wakes up from sleep

Component: Access Policy Manager

Symptoms:
EdgeClient doesn't cleanup routing table before windows goes to hibernate. This may result in establishment of VPN when computer wakes up. It may also result in other network connectivity issues

Conditions:
-VPN connection is not disconnected
-Computer goes in hibernation

Impact:
Issues with Network connectivity

Workaround:
Renew DHCP lease by running
ipconfig/renew.

or

reboot the machine.


597394-1 : Improper handling of IP options

Solution Article: K46535047


597214-2 : Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly

Component: Access Policy Manager

Symptoms:
JavaScript code with literal object definition containing field names equal to reserved keywords is not handled correctly by Portal Access.

Conditions:
JavaScript code with literal object definition containing fields with reserved keywords as a name, for example:

var a = { default: 1, continue: 2 };

Impact:
JavaScript code is not rewritten and may not work correctly.

Workaround:
It is possible to use iRule to rename field names in original code.

Fix:
Now JavaScript with literal object definition containing reserved keywords as field names is handled correctly by Portal Access.


597089-5 : Connections are terminated after 5 seconds when using ePVA full acceleration

Component: Local Traffic Manager

Symptoms:
When using a fast L4 profile with ePVA full acceleration configured, the 5-second TCP 3WHS handshake timeout is not being updated to the TCP idle timeout after the handshake is completed. The symptom is an unusually high number of connections getting reset in a short period of time.

Conditions:
It is not known all of the conditions that trigger this, but it is seen when using the fast L4 profile with pva-acceleration set to full.

Impact:
High number of connections get reset, longer than expected idling TCP connections, and potential performance issues.

Workaround:
Disabling the PVA resolves the issue.


597023-4 : NTP vulnerability CVE-2016-4954

Solution Article: K82644737


597010-4 : NTP vulnerability CVE-2016-4955

Solution Article: K03331206


596997-4 : NTP vulnerability CVE-2016-4956

Solution Article: K64505405


596945-2 : AVR DNS record lost after upgrade.

Component: Application Visibility and Reporting

Symptoms:
After upgrading to 11.5.1 through 11.6.0, you are unable to view DNS stats in AVR.

Conditions:
AVR enabled, DNS statistics visible in a version prior to 11.5.1, then upgrade to versions 11.5.1 through 11.6.0.

Impact:
You will be unable to view the DNS statistics.

Fix:
Fixed an issue with DNS stats not displaying in AVR after upgrade.


596814-3 : HA Failover fails in certain valid AWS configurations

Component: TMOS

Symptoms:
Some of the floating object's IPs might not be reattached to the instance acting as the new active device.

Conditions:
AWS deployments where there are multiple coincidences for the provided IP address (corresponding to other Amazon VPCs in the same Availability Zone containing unrelated instances but having the same IP address as the BIG-IP's floating IP address.

Impact:
Potential traffic disruption. Some of the floating object's IPs might not be reattached to the instance acting as the new active device.

Workaround:
Do not have AWS deployments with multiple VPCs sharing the same IP address as the BIG-IP's floating IP address.

Fix:
Failover now narrows network description by filtering with VPC id.


596619 : Some 10.2.x client SSL configurations fail to upgrade to 11.6.1.

Solution Article: K00539510

Component: Local Traffic Manager

Symptoms:
Some 10.2.x client SSL configurations fail to upgrade to 11.6.1. The upgrade fails with an error similar to the following:

emerg load_config_files: "/usr/libexec/bigpipe load" - failed. -- BIGpipe parsing error (/config/bigpipe/BIG-IP.conf Line 67): 012e0020:3: The requested item (myclientssl {) is invalid (<profile arg> ` show ` list ` edit ` delete ` stats reset) for 'profile'.

Conditions:
Running 10.2.x with a Client SSL profile that has a custom Certificate and Key, and attempting to upgrade to version 11.6.1 or higher.

Impact:
The system fails to upgrade and presents a bigpipe parsing error.

Workaround:
If you have already upgraded and are encountering this issue, do the following:
1. Make a backup copy of /config/bigpipe/BIG-IP.conf.
2. Edit /config/bigpipe/BIG-IP.conf and remove any reference to inherit-certificatechain in the affected ssl profiles.
3. Run /usr/libexec/bigpipe daol.
4. Run tmsh save sys config.
5. Run tmsh load sys config.

This should install the configuration after upgrade failure.

Fix:
A 10.2.x configuration containing a Client SSL profile with a custom Certificate and Key now successfully upgrades to 11.6.1.


596603-11 : AWS: BIG-IP VE doesn't work with c4.8xlarge instance type.

Component: TMOS

Symptoms:
When deploying BIG-IP VE in AWS with c4.8xlarge instance type, the system never boots and remains in "Stopped" state after briefly trying to start-up.

Conditions:
BIG-IP VE is deployed with c4.8xlarge instance type in AWS.

Impact:
c4.8xlarge instance type are not supported for BIG-IP VE in AWS.

Workaround:
Choose c4.4xlarge or other instance types in AWS.

Fix:
Issue corrected so that BIG-IP VE will work with c4.8xlarge instance type AWS.


596569-2 : Memory leak on Central device in Symmetric deployment

Component: WebAccelerator

Symptoms:
When AAM is provisioned and symmetric configuration is deployed, a central unit will suffer a memory leak.

Conditions:
AAM is provisioned and a symmetric deployment is used.

Impact:
Due to memory leak BIG-IP will run out of memory and won't be able to properly serve new requests.

Fix:
It immediately releases a memory allocation which previously leaked once the allocation is no longer required.


596488-4 : GraphicsMagick vulnerability CVE-2016-5118.

Solution Article: K82747025


596340-3 : F5 TLS vulnerability CVE-2016-9244

Solution Article: K05121675


596116-2 : LDAP Query does not resolve group membership, when required attribute(s) specified

Component: Access Policy Manager

Symptoms:
Corresponding session variable session.ldap.last.memberOf contains only the groups user has explicit membership.

Conditions:
This occurs when the following conditions are met:
-- When APM LDAP Query is configured with option "Fetch groups to which the user or group belong" is set to "All".
-- The Required Attribute includes the "memberOf" LDAP attribute.

Impact:
Only groups the user is a direct member of will be populated to the APM 'session.ldap.last.memberOf' variable.

Workaround:
Add the following attribute to the "Required Attributes" list:

"objectClass"

If APM is communicating via LDAP with Microsoft Active Directory, consider adding this attribute to the list:

"primaryGroupID"

Note: Adding the "primaryGroupID" attribute will cause APM to fetch all groups Microsoft Active Directory, including the primary group.

Fix:
LDAP Query now retrieves groups from the backend server in accordance with option "fetch groups to which the user or group belong". it doesn't matter if any required attribute set or not set.


595874-4 : Upgrading 11.5.x/11.6.x hourly billing instances to 12.1.0 fails due to license SCD.

Component: TMOS

Symptoms:
BIG-IP Virtual Edition (VE) instances that use the Amazon Web Services (AWS) hourly billing license model may fail when upgrading to version 12.1.0.

As a result of this issue, you may encounter the following symptom:

After upgrading to version 12.1.0, the BIG-IP VE instance license is invalid.

Conditions:
This issue occurs when all of the following conditions are met:

-- You have BIG-IP VE instances that use the hourly billing licensing model.
-- Your BIG-IP VE instances are running 11.5.x or 11.6.x software versions.
-- Your BIG-IP VE instances are running within the AWS EC2 environment.
-- You upgrade the BIG-IP VE instance using the liveinstall method.

Impact:
BIG-IP VE instance licenses are not valid after upgrading to software version 12.1.0.

Workaround:
To work around this issue, you can use the liveinstall method on the hotfix image directly (instead of installing the base software image and then the hotfix image). To do so, perform the following procedure:

Impact of workaround: Performing the following procedure requires rebooting the system and should be performed only during a maintenance window.

Download the BIGIP-12.1.0.0.0.1434.iso and Hotfix-BIGIP-12.1.0.1.1.1447-HF1-ENG.iso files to your workstation. For more information about downloading software, refer to SOL167: Downloading software and firmware from F5.
Copy the downloaded files from your workstation to the /shared/images directory on the VE instance.
To perform the installation by using the liveinstall method, and reboot the BIG-IP VE instance to the volume running the new software, use the following command syntax:

tmsh install sys software hotfix Hotfix-BIGIP-12.1.0.1.1.1447-HF1-ENG.iso volume <volume-number> reboot

For example, to install the hotfix to volume HD1.3 and reboot to the volume running the newly installed software, type the following command:

tmsh install sys software hotfix Hotfix-BIGIP-12.1.0.1.1.1447-HF1-ENG.iso volume HD1.3 reboot
 
Verify the installation progress by typing the following command:
tmsh show sys software

Output appears similar to the following example:

Sys::Software Status
Volume Product Version Build Active Status
----------------------------------------------------------------
HD1.1 BIG-IP 12.0.0 0.0.606 yes complete
HD1.2 BIG-IP 12.1.0 0.0.1434 no complete
HD1.3 BIG-IP 12.1.0 0.0.1434 no installing 6.000 pct

Fix:
BIG-IP VE instances that use the AWS hourly billing license model now complete successfully when upgrading to version 12.1.0.


595773-3 : Cancellation requests for chunked stats queries do not propagate to secondary blades

Component: TMOS

Symptoms:
Canceling a request for a chunked stats query (e.g. hitting ctrl-c during "tmsh show sys connection") does not stop data flowing from secondary blades.

Conditions:
A chassis-based system with multiple blades. Users must execute a chunked stats query (e.g. "tmsh show sys connection") and then cancel it before it finishes (e.g. with ctrl-c in tmsh).

Impact:
Unnecessary data will be sent from TMM to secondary mcpd instances, as well as from secondary mcpd instances to the primary mcpd instance. This could cause mcpd to restart unexpectedly.

Fix:
Cancellations for chunked stats queries are now propagated to secondary blades.


595275-2 : Virtual IP address change might cause VIP state to go from GREEN to RED to GREEN

Component: Local Traffic Manager

Symptoms:
Virtual IP address change might cause VIP state to go from GREEN to RED to GREEN when pool goes empty.

Conditions:
This occurs when the configuration contains a pool with only one FQDN pool member.

Impact:
VIP can go briefly RED and offline.

Workaround:
Configuring a fallback static IP node or multiple FQDN pool members removes this risk.


595270 : Memory leaks when session DB tables gets updated

Component: Traffic Classification Engine

Symptoms:
Memory usage stats indicate possible memory leaks.

Conditions:
When CEC flow bundling is used.

Impact:
Potential memory leaks.

Workaround:
Disable CEC flow bundling (tmm.gpa.cec.flow_bundling.enable = false).


594642-1 : Stream filter may require large allocations by Tcl leading TMM to core on allocation failure.

Component: Local Traffic Manager

Symptoms:
Stream filter may require large allocations by Tcl leading TMM to core on allocation failure.

Conditions:
Stream filter is active during low memory situations

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
Stream may now be configured to parse xbufs in chunks. This limits the maximum amount of memory required and reduces the chance of an allocation failure.


594496-3 : PHP Vulnerability CVE-2016-4539

Solution Article: K35240323


593667 : Dashboard displays incomplete alert details when Polish characters are included

Component: Fraud Protection Services

Symptoms:
Polish alerts are not fully displayed fully in the dashboard.

Conditions:
Alert details contain Polish characters.

Impact:
Causes difficulty assigning alert severity.

Workaround:
None

Fix:
Alerts are now displayed correctly.


593530-1 : In rare cases, connections may fail to expire

Component: Local Traffic Manager

Symptoms:
Connections have an idle timeout of 4294967295 seconds.

Conditions:
Any IP (ipother) profile is assigned to virtual server.

Impact:
Connections may linger.

Workaround:
None.

Fix:
Fixed idle initialization error when using Any IP (ipother) profile.


593447-2 : BIG-IP TMM iRules vulnerability CVE-2016-5024

Solution Article: K92859602


593070-5 : TMM may crash with multiple IP addresses per session

Component: Policy Enforcement Manager

Symptoms:
TMM crash

Conditions:
A session with multiple IP addresses with PCRF communication for dynamic policy management may have a crash credits to a race condition.

Impact:
Traffic disrupted while tmm restarts.

Fix:
Check for timer expiration prior to processing the timer.


592871-2 : Cavium Nitrox PX/III stuck queue diagnostics missing.

Component: Local Traffic Manager

Symptoms:
Diagnostics tool to investigate rare issue where the Cavium Nitrox PX/III crypto chip gets into a "request queue stuck" situation.

Conditions:
System with Cavium Nitrox PX/III chip(s) which includes the BIG-IP 5xxx, 7xxx, 10xxx, and 12xxx platforms as well as the VIPRIOn B2200 blade, that hits a rare issue which logs a "request queue stuck" message in /var/log/ltm.

Impact:
This tool enables F5 engineers to obtain more data about this problem to help diagnose the issue.

Workaround:
None.

Fix:
Provides a diagnostics tool. Does not directly mitigate the problem.


592870-3 : Fast successive MTU changes to IPsec tunnel interface crashes TMM

Component: TMOS

Symptoms:
Changing IPsec tunnel interface MTU attribute repeatedly in quick succession, TMM cores. This can occur whether or not traffic has flowed through the tunnel.

Conditions:
This occurs when quickly changing the IPsec tunnel interface MTU.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Change IPsec tunnel interface attributes at a rate of speed that allows each configuration modification to complete.

Fix:
TMM no longer cores if users quickly and repeatedly change interface attributes (for example, the MTU interface attribute).


592868-4 : Rewrite may crash processing HTML tag with HTML entity in attribute value

Component: Access Policy Manager

Symptoms:
If HTML page contains HTML entities in attribute values, rewrite may crash processing this page.

Conditions:
HTML tag like this:
<script src="&#10;" type="text/javascript"></script>

Impact:
Web application may not work correctly.

Workaround:
In most cases HTML entities can be replaced by appropriate characters by iRule.

Fix:
Now rewrite correctly handles HTML entities in attribute values.


592854-4 : Protocol version set incorrectly on serverssl renegotiation

Component: Local Traffic Manager

Symptoms:
If the BIG-IP serverssl profile sends a new ClientHello request to renegotiate SSL, the protocol version will be set to 0. This will cause renegotiation to fail.

Conditions:
ServerSSL profile configured on a virtual server, and BIG-IP initiates a renegotiation.

Impact:
Protocol field is invalid (0), and the server will reset the connection.

Fix:
Fixed a reset issue with SSL renegotiation in the serverssl profile.


592784-4 : Compression stalls, does not recover, and compression facilities cease.

Component: Local Traffic Manager

Symptoms:
Compression stalls, does not recover, and compression facilities may cease.

Conditions:
A device error of any kind, or requests that result in the device reporting an error (for example, attempting to decompress an invalid compression stream).

Impact:
In general, compression stops altogether. Under some circumstances, compression requests may end up routed to zlib (software compression), but generally the SSL hardware accelerator card does not correctly report that it is unavailable when it stalls.

Workaround:
Select the softwareonly compression provider by running the following tmsh command: tmsh modify sys db compression.strategy value softwareonly.

Fix:
The compression device driver now attempts to recover after a failure. If it still cannot recover, new compression requests will be assigned to zlib (software) for compression.


592591-1 : Deleting access profile prompts for apply access policy for other untouched access profiles

Component: Access Policy Manager

Symptoms:
After deleting an access profile, the 'Apply Access Policy' link shows up and the status flags for some other untouched access profiles turn yellow. Also, there are APM log messages indicating that the configurations for those untouched access profile have been changed.

Conditions:
If an access profile containing macros is copied on the admin UI and is deleted subsequently.

Impact:
There is no change to the access profiles that are affected by the deletion. Admin can go ahead to click "Apply Access Policy" link to make the link disappear.


592497-2 : Idle timeout ineffective for FIN_WAIT_2 when server-side expired and HTTP in fallback state.

Component: Local Traffic Manager

Symptoms:
While passing normal traffic, CPU utilization of one or more tmms suddenly goes to 100% as viewed by top and remains there indefinitely.

Conditions:
Idle timeout for tcp flows in FIN_WAIT_2.

Impact:
There is a rare occurrence in which tmm might result in 100% CPU busy.

Workaround:
None.

Fix:
This release honors the idle timeout in FIN_WAIT_2 when server-side expired and HTTP in fallback state.


592485-2 : Linux kernel vulnerability CVE-2015-5157

Solution Article: K17326


592414-2 : IE11 and Chrome throw "Access denied" during access to any generic window property after document.write() into its parent has been performed

Component: Access Policy Manager

Symptoms:
IE11 and Chrome throw "Access denied" during access to any generic window property after document.write() into its parent has been performed from dynamically generated child.

Conditions:
Browsers: IE11 and Chrome
When: After document.write() into its parent has been performed from dynamically generated child.

Impact:
Web application malfunction.

Workaround:
None.

Fix:
Fixed.


592113-1 : tmm core on the standby unit with dos vectors configured

Component: Advanced Firewall Manager

Symptoms:
On the standby unit with mirrored connections configured, uninitialized dos_vectors may cause core dump

Conditions:
HA setup, mirroring enabled on a virtual that has dos vectors configured

Impact:
Traffic disrupted while tmm restarts.


592070-1 : DHCP server connFlow when created based on the DHCP client connFlow does not have the traffic group ID copied

Component: Policy Enforcement Manager

Symptoms:
Variables in the flow context when stored in the sessionDB cannot be shared since the traffic groups of the server and client flows are different.

Conditions:
DHCP virtual created in a non-local traffic group.

Impact:
Variable sharing in the TCL context will not work.

Workaround:
Modify SysDb variable "Tmm.SessionDB.match_ha_unit" to disable the use of traffic-group ID while accessing the sessionDB.

Fix:
Copy the traffic group from client to server connFlows such that both connFlows have the same traffic group.


592001-2 : CVE-2016-4073 PHP vulnerabilities

Solution Article: K64412100


591918-4 : ImageMagick vulnerability CVE-2016-3718

Solution Article: K61974123


591908-4 : ImageMagick vulnerability CVE-2016-3717

Solution Article: K29154575


591894-4 : ImageMagick vulnerability CVE-2016-3715

Solution Article: K10550253


591881-4 : ImageMagick vulnerability CVE-2016-3716

Solution Article: K25102203


591857 : 10-core vCMP guest with ASM may not pass traffic

Component: TMOS

Symptoms:
The TMM plugin manager does not expect/support an ASM guest configuration of 10 cores, thus its calculations as to the number of devices required and numbering does not match the existing number of threads/devices.

Conditions:
11.6.0 HF6
ASM provisioned on a vCMP guest
10 CPU cores allocated to an ASM guest

Impact:
System may not start or may exhibit intermittent failures.

Workaround:
Change the number of cores on the ASM guest to use either 8 CPU cores or 12 CPU cores.

Fix:
This issue was partially fixed in 11.6.0 HF6, but the tmplugin RPM was incorrect. This fix includes the proper RPM.


591806-3 : ImageMagick vulnerability CVE-2016-3714

Solution Article: K03151140


591789-1 : IPv4 fragments are dropped when packet filtering is enabled.

Component: Local Traffic Manager

Symptoms:
IPv4 fragments are dropped when packet filtering is enabled.

Conditions:
Packet filtering is enabled on version 11.5.4, 11.6.0 HF6, or 11.6.1.

Impact:
IPv4 fragments with a non-zero offset are lost.

Workaround:
Disable packet filtering.

Fix:
IPv4 fragments are no longer incorrectly dropped when packet filtering is enabled.


591767-3 : NTP vulnerability CVE-2016-1547

Solution Article: K11251130


591733-2 : Save on Auto-Sync is missing from the configuration utility.

Solution Article: K83175883

Component: TMOS

Symptoms:
The option to configure save-on-auto-sync is missing in the Device Management GUI.

Conditions:
Devices configured in a DSC configuration.
Automatic with Full or Incremental Sync is enabled.
You attempt to configure the save-on-auto-sync option from the GUI.

Impact:
You will need to have TMSH access to the BIG-IP system to perform this task.

Workaround:
You will need to have TMSH access to the BIG-IP system to perform this task.

Fix:
This release adds per-device-group save_on_auto_sync flag to GUI: flag now shows in GUI and correctly saves.
GUI: The "Sync Type" option in the GUI must be set to "Automatic with Full/Incremental Sync" in order for "Save on Auto-Sync" option to show.

Behavior Change:
Beginning in version 11.5.0, the /cm trust-domain 'save-on-auto-sync' attribute is no longer configured as part of the trust-domain, but is part of the configuration of a device group. With this change, the option to set that attribute becomes available in the GUI on the condition that the "Sync Type" option is set to "Automatic with Full/Incremental Sync".


591659-3 : Server shutdown is propagated to client after X-Cnection: close transformation.

Solution Article: K47203554

Component: Local Traffic Manager

Symptoms:
Server shutdown is propagated to client after X-Cnection: close transformation.

Conditions:
In OneConnect configurations, when a server's maximum number of keep-alives is exceeded, the server closes the connection between itself and the BIG-IP system. This Connection: Close is transformed to an X-Cnection: close and sent to the Client along with a TCP FIN.

Impact:
Client side connections are closed by the BIG-IP system too early, causing subsequent requests to be dropped.

Workaround:
Set the OneConnect profile "Maximum Reuse" value to 2 below the value of the pool members max keep-alive setting. This forces OneConnect to close the connection before the pool member.

Fix:
Server shutdown is no longer propagated to client after X-Cnection: close transformation, so client side connections are now kept open by the BIG-IP system as expected, and subsequent requests are no longer dropped.


591476-8 : Stuck crypto queue can erroneously be reported

Solution Article: K53220379

Component: Local Traffic Manager

Symptoms:
In some cases, a stuck crypto queue can be erroneously detected on Nitrox-based systems (Nitrox PX and Nitrox 3). When the tmm/crypto stats are examined, they show no queued requests. The following message appears in the ltm log: Device error: crypto codec cn-crypto-0 queue is stuck.

Conditions:
-- Running on one of the following platforms:
 + BIG-IP 800, 1600, 3600, 3900, 6900, 89xx, 5xxx, 7xxx, 10xxx, 11xxx, and 12xxx
 + VIPRION B41xx-B43xx, B21xx, and B22xx blades.
-- Performing SSL.
-- Under heavy load.

Impact:
Device errors reported in logs and crypto HA action is taken, possibly resulting in failing over.

Workaround:
Modify the crypto queue timeout value to 0 to prevent timeouts using the following command:

tmsh modify sys db crypto.queue.timeout value 0

Fix:
The crypto driver now only examines requests in the hardware DMA ring to detect a stuck queue.


591455-2 : NTP vulnerability CVE-2016-2516

Solution Article: K24613253


591447-3 : PHP vulnerability CVE-2016-4070

Solution Article: K42065024


591438-2 : PHP vulnerability CVE-2015-8865

Solution Article: K54924436


591343-2 : SSL::sessionid output is not consistent with the sessionid field of ServerHello message.

Component: Local Traffic Manager

Symptoms:
SSL::sessionid output is not consistent with the sessionid field of ServerHello message. This is mostly cosmetic, but if an iRule depends upon the outcome, the result can be unexpected.

Conditions:
This occurs when using an iRule to inspect the session ID on server-side SSL.

Impact:
The values do not match. SSL::sessionid outputs the wrong sessionid.

Workaround:
None.

Fix:
The returned session ID in both the SERVERSSL_SERVERHELLO and SERVERSSL_HANDSHAKE events is the one presented by the SSL server.


591329-2 : CVE-2016-2108 fixed in Oracle Access Manager library used by BIG-IP APM

Solution Article: K36488941


591328-2 : OpenSSL vulnerability CVE-2016-2106

Solution Article: K36488941


591327-2 : OpenSSL vulnerability CVE-2016-2106

Solution Article: K36488941


591325-2 : OpenSSL (May 2016) CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109

Solution Article: K75152412


591268-3 : VS hostname is not resolvable when DNS Relay proxy is installed and running under certain conditions

Component: Access Policy Manager

Symptoms:
VS hostname is not resolvable when DNS Relay proxy is installed and running under certain conditions, it depends on client machine configuration. Symptom: negative record in windows DNS cache, can be verified by running ipconfig /displaydns

Conditions:
Specific client machine configuration

Impact:
VS hostname is not resolvable:
- 'Refresh' of webtop causes unavailable webtop
- Recurring check report may fail due to DNS resolve issue

Workaround:
* Clean windows DNS cache: ipconfig /flushdns
or
* Disable DNS Relay proxy service

Fix:
Now DNS Relay proxy service cleans up DNS cache after initialization mitigating issue described


591117-1 : APM ACL construction may cause TMM to core if TMM is out of memory

Component: Access Policy Manager

Symptoms:
During ACL construction, TMM send queries regarding assigned ACL information. If the reply message contains error message of out-of-memory, TMM was not handling this error message properly, and cause TMM to core.

Conditions:
BIG-IP is extremely loaded and out of memory.

Impact:
Traffic disrupted while tmm restarts.

Fix:
When handling the error reply message of out-of-memory during ACL construction, TMM can handle it without causing TMM to crash.


591104-3 : ospfd cores due to an incorrect debug statement.

Component: TMOS

Symptoms:
ospfd cores due to an incorrect debug statement.

Conditions:
This occurs in NSSA configs when ASE OSPF debugging enabled in imish (for example, by running the command: debug ospf route ase). Affected configuration commands are (in imish):
debug ospf all.
debug ospf route.
debug ospf route ase.

Impact:
ospfd might crash, interrupting dynamic routing.

Workaround:
Do not enable debugging in ospf that includes 'route ase'.

Fix:
ospfd no longer crashes when debugging is enabled in imish.


591042-5 : OpenSSL vulnerabilities

Solution Article: K23230229


590904-5 : New HA Pair created using serial cable failover only will remain Active/Active

Component: TMOS

Symptoms:
After creating a new sync-failover device group without network failover enabled, both devices remain Active.

Conditions:
Create a new sync-failover device-group without enabling network failover.

Impact:
Both device in the HA pair will be Active, which is unlikely to pass traffic successfully.

Workaround:
After adding the 2nd device to the sync-failover group, restart sod with "bigstart restart sod" on both devices.

Fix:
After creating the sync-failover group with without network failover configured, but a serial failover cable installed, one of the devices becomes Standby and the other remains Active.


590820-2 : Applications that use appendChild() or similar JavaScript functions to build UI might experience slow performance in Microsoft Internet Explorer browser.

Component: Access Policy Manager

Symptoms:
Applications that use appendChild() or similar JavaScript functions to build UI might experience slow performance in Microsoft Internet Explorer browser.

Conditions:
Intense usage of JavaScript methods such as: appendChild(), insertBefore(), and other, similar JavaScript methods, in a customer's web application code.

Impact:
Very low web application performance when using Microsoft Internet Explorer.

Workaround:
None.

Fix:
Applications that use appendChild() or similar JavaScript functions to build UI now experience expected performance in Microsoft Internet Explorer browser.


589794 : APD might crash if LDAP Query agent failed to retrieve primary group for a user

Component: Access Policy Manager

Symptoms:
APD will crash and generate a core file.

Conditions:
The problem can happen only when the following is true:
1. LDAP Query is used with AD backend
2. "Fetch groups to which the user or group belong" is defined other value than None (direct/all)
3. There were logins to bigip before, so group cache is built and valid
4. New group created in the domain and assigned as a primary group for the user trying to authenticate

Impact:
Authentication service will be interrupted.

Workaround:
Administrator should reset group cache using either GUI (AAA LDAP Server configuration page) or tmsh (apm aaa ldap object). After cache is reset, it will be built from scratch on next request and the new group will be added to the cache.


589256-3 : DNSSEC NSEC3 records with different type bitmap for same name.

Component: Global Traffic Manager

Symptoms:
For a delegation from a secure zone to an insecure zone, BIG-IP returns different type bitmaps in the NSEC3 record depending on the query type. This causes BIND9's validator to reject the secure delegation to the insecure zone.

Conditions:
For insecure delegations, our DNSSEC implementation does not support the DS record. Those queries are forwarded to the backend, BIND if selected as fallback. Without ZSK/KSK for an insecure child zone, BIND responds SOA which we dynamically sign.

Impact:
DNS lookups may fail if BIND9's validator rejects the delegation.

Workaround:
None.

Fix:
If response is a NODATA from either the proxy or a transparent cache, and the query is a DS, set the types bitmap to NS.


589223-3 : TMM crash and core dump when processing SSL protocol alert.

Component: Local Traffic Manager

Symptoms:
TMM crash and core dump when processing SSL protocol alert.

Conditions:
During SSL handshake, if the server sends protocol Alert to the BIG-IP system, TMM might crash.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
A problem of TMM restarting when processing SSL protocol alert has been fixed.


589118 : Horizon View client throws an exception when connecting to Horizon 7 VCS through APM.

Solution Article: K81314569

Component: Access Policy Manager

Symptoms:
If APM is configured as PCoIP proxy against Horizon 7 VCS, the Horizon View client fails to retrieve the list of entitlements with an exception written in its logs.

Conditions:
APM as PCoIP proxy for Horizon 7 View Connection Server.

Impact:
Horizon View client cannot be used with APM to access Horizon 7.

Workaround:
You can use the following iRule to update the broker protocol version returned by APM to be 11.0 instead of 9.0.

when HTTP_REQUEST {
   if { [HTTP::header "Origin"] ne "" } {
        HTTP::header remove "Origin"
    }
     if { [ HTTP::method ] == "POST" && [ HTTP::uri ] == "/broker/xml" } {
        set BROKER_REQUEST 1
        HTTP::collect [HTTP::header Content-Length]
    }
}

when HTTP_REQUEST_DATA {
    if { [ info exists BROKER_REQUEST ] && [ regexp {<have-authentication-types[ \t\r\n]*>[ \t\r\n]*<name[ \t\r\n]*>[ \t\r\n]*saml[ \t\r\n]*</name>[ \t\r\n]*</have-authentication-types>} [HTTP::payload] ] } {
        HTTP::respond 200 content {<?xml version="1.0" encoding="UTF-8"?><broker version="11.0"><set-locale><result>ok</result></set-locale><configuration><result>ok</result><broker-guid>1</broker-guid><authentication><screen><name>saml</name><params></params></screen></authentication></configuration></broker>} Content-Type text/xml
    }
}

when HTTP_RESPONSE {
    if { ! [ IP::addr [ IP::remote_addr ] equals 127.0.0.0/8 ] } { return }
    set BROKER_RESPONSE 1
    set content_length 0
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
        set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length 1048576
    }
    # Check if $content_length is not set to 0
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
}

when HTTP_RESPONSE_DATA {
    if { ! [ info exists BROKER_REQUEST ] || ! [ info exists BROKER_RESPONSE ] } { return }
    regsub "<broker version=\"9.0\">" [HTTP::payload] "<broker version=\"11.0\">" payload
    HTTP::payload replace 0 [HTTP::payload length] $payload
    HTTP::release
}

Fix:
Horizon View client can now be used with APM to access Horizon 7.


588888-2 : Empty URI rewriting is not done as required by browser.

Solution Article: K80124134

Component: Access Policy Manager

Symptoms:
Empty URI must be rewritten at server side and client side rewriter in the same way: as empty URI (all browsers treat this type of URI in a specific way).

Conditions:
A tag with an empty 'src' or 'href' attribute.

Impact:
Web application malfunction, such as incorrect or unexpected behavior or error messages.

Workaround:
Use an application-specific iRule that modifies the empty URI.
-- For example, for JavaScript methods such as setAttribute(), an iRule should change this:
'F5_Invoke_setAttribute(o, "src", uri)'
to this:
'(uri=="")?o.setAttribute("src", uri):F5_Invoke_setAttribute(o, "src", uri)'.

-- As another example, for JavaScript methods such as write(str), writeln(str), innerHTML=str, outerHTML=str, and similar methods, if str contains <img src="" ... >, the iRule must remove the src attribute.

Fix:
This release fixes the issue of rewriting the empty URI the same way at the server side and client side: as empty URI (all browsers treat this type of URI in a specific way).


588496-3 : SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541

Solution Article: K10737


588442-3 : TMM can core in a specific set of conditions.

Component: Local Traffic Manager

Symptoms:
TMM can core and assert: 'ifc not set'.

Conditions:
This occurs under the following conditions:
  - A unit with license that ratelimits throughput performance to something other than max or 1.
  - One or more virtual IP addresses configured with DNS profiles with rapid-response enabled.
  - Something causing the listener to be disabled or a listener to not be found.
  - A DNS request sent to the disabled listener.

Impact:
TMM might core and assert: 'ifc not set'.

Workaround:
None.


588351-2 : IPv6 fragments are dropped when packet filtering is enabled.

Component: Local Traffic Manager

Symptoms:
IPv6 fragments are dropped when packet filtering is enabled.

Conditions:
Packet filtering is enabled and the system is processing IPv6 fragments.

Impact:
IPv6 fragments with a non-zero offset are lost.

Workaround:
Disable packet filtering.

Fix:
IPv6 fragments are no longer dropped when packet filtering is enabled.


588289-4 : GTM is Re-ordering pools when adding pool including order designation

Component: Global Traffic Manager

Symptoms:
GTM re-orders, including the "0" order when adding the pool with specific order designation.

Conditions:
This occurs when adding pools with a specified order.

Impact:
This changes the pool order unexpectedly which will affect Load balancing using global-availability.


588115-3 : TMM may crash with traffic to floating self-ip in range overlapping route via unreachable gw

Component: Local Traffic Manager

Symptoms:
As a result of a known issue TMM may crash in some specific scenarios if there is an overlapping and more specific route to the floating self-IP range configured on the unit.

Conditions:
- Unit configured with a floating self-IP and allow-service != none.
  - More specific route exists via GW to the self-IP.
  - Configured gateway for the overlapping route is unreachable.
  - Ingress traffic to the floating self-IP.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid the use of routes overlapping with configured floating self-IPs.

Fix:
TMM no longer crashes when floating self IPs are configured with more specific overlapping routes.


587966-3 : LTM FastL4 DNS virtual server: first A query dropped when A and AAAA requested at the same time with same source IP:port

Solution Article: K77283304

Component: Local Traffic Manager

Symptoms:
LTM FastL4 DNS virtual server or SNAT: first A query dropped when A and AAAA requested at the same time with same source IP:port.

Conditions:
A and AAAA DNS Query requested at the same time with the same source IP and Port.

Impact:
A Type DNS Query dropped intermittently.

Workaround:
Configure a standard virtual server with a UDP profile for the traffic instead of using FastL4 or SNAT.

Fix:
Type A requests no longer dropped when A and AAAA DNS Query requested at the same time with the same source IP and Port.


587892-1 : Multiple iRule proc names might clash, causing the wrong rule to be executed.

Component: Local Traffic Manager

Symptoms:
Multiple iRule proc names might clash, causing the wrong rule to be executed.

Conditions:
This occurs when there is an iRule configured with more than one proc, which might cause the wrong proc to get executed.

Impact:
The call proc might execute the wrong proc.

Workaround:
None.

Fix:
Multiple iRules configured with more than one proc no longer cause the wrong proc to get executed.


587698-2 : bgpd crashes when ip extcommunity-list standard with route target(rt) and Site-of-origin (soo) parameters are configured

Component: TMOS

Symptoms:
bgpd daemon crashes

Conditions:
bgp extended-asm-cap is configured before configuring
ip extcommunity-list standard with rt and soo fields.

Impact:
bgpd daemon crashes leading to route loss and traffic loss.

Fix:
bgpd does not crash when both bgp extended-asm-cap and
ip extcommunity-list standard with rt and soo parameters are configured.


587656-3 : GTM auto discovery problem with EHF for ID574052

Component: Global Traffic Manager

Symptoms:
After applying EHF9-685.88-ENG to CRCGTMCS101, many WideIPs such as CRT-LEGAL-SERVICE.gslb.global or OneEvent.gslb.global are unexpectedly status Checking instead of Available.

Conditions:
After applying EHF9-685.88-ENG

Impact:
Many WideIPs such as CRT-LEGAL-SERVICE.gslb.global or OneEvent.gslb.global are unexpectedly status Checking instead of Available.

Workaround:
Skip to the next Eng HF
v11.4.1-hf10/hotfix/HF10-690.10-ENG

Fix:
This problem only occurs with the one faulty EHF9-685.88-ENG and does not occur anywhere else.


587617-3 : While adding GTM server, failure to configure new IP on existing server leads to gtmd core

Component: Global Traffic Manager

Symptoms:
gtmd core with SIGSEGV in selfip_needs_xlation.

Conditions:
No GTM server object configured with existent selfip.

Impact:
gtmd cores. GTM unable to respond to DNS queries. DNS traffic disrupted while gtmd restarts.

Workaround:
Configure the GTM server object with an existent selfip. For more information, see K15671: The BIG-IP GTM system must use a local self IP address to define a server to represent the BIG-IP GTM system at https://support.f5.com/csp/#/article/K15671

Fix:
gtmd will not core.


587077-3 : Samba vulnerabilities CVE-2015-5370 and CVE-2016-2118

Solution Article: K37603172


586878-2 : During upgrade, configuration fails to load due to clientssl profile with empty cert/key configuration.

Component: TMOS

Symptoms:
During upgrade, configuration fails to load due to invalid clientssl profile cert/key configuration. The validation to verify whether at least one valid key/cert pair exists in clientssl profiles was enforced in software versions through 11.5.0. This validation was not in effect in versions 11.5.1, 11.5.2, and 11.5.3.

The lack of validation resulted in invalid clientssl profiles (those containing empty key/certs or a cert/key of 'default'). When you upgrade such a configuration to 11.5.4 or later, you will receive a validation error, and the configuration will fail to load after upgrade.

Conditions:
The issue occurs when all the below conditions are met.
1. You have a clientssl profile in a configuration from a version without validation (that is, 11.5.1, 11.5.2, or 11.5.3).
2. The clientssl profile in the configuration has an empty cert/key, or a cert/key of 'default'.
3. You upgrade to a version that has the cert/key validation (specifically, 11.5.4, 11.6.0, 11.6.1, and versions 12.1.0 and later).

Impact:
Configuration fails to load. The system posts an error message that might appear similar to one of the following:
-- 01070315:3: profile /Common/my_client_ssl requires a key Unexpected Error: Loading configuration process failed.
-- 01071ac9:3: Unable to load the certificate file () - error:2006D080:BIO routines:BIO_new_file:no such file.
Unexpected Error: Loading configuration process failed.

Workaround:
To workaround this situation, modify the configuration file before upgrading:
1. Check the config file /config/bigip.conf.
2. Identify the clientssl profile without a cert/key.
    For example, it might look similar to the following:
    ltm profile client-ssl /Common/cssl_no-cert-key2 {
        app-service none
        cert none
        cert-key-chain {
            "" { }
        }
        chain none
        defaults-from /Common/clientssl
        inherit-certkeychain false
        key none
        passphrase none
    }

   Note: The profile might have cert-key-chain name but not the cert/key. In other words, it could also appear similar to the following example:
    ltm profile client-ssl /Common/cssl_no-cert-key2 {
        app-service none
        cert none
        cert-key-chain {
            default { }
        }
        chain none
        defaults-from /Common/clientssl
        inherit-certkeychain false
        key none
        passphrase none
    }
3. Remove the clientssl profile from /config/bigip.conf.
4. Run the command: tmsh load sys conf.
5. Re-create the clientssl profiles you need.


586738-2 : The tmm might crash with a segfault.

Component: Local Traffic Manager

Symptoms:
The tmm might crash with a segfault.

Conditions:
Using IPsec with hardware encryption.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
IPsec is configured with hardware encryption error now returns an error code when appropriate, and manages the error as expected, so tmm no longer crashes with a segfault.


586718-3 : Session variable substitutions are logged

Component: Access Policy Manager

Symptoms:
With the log level set to debug, session variable substitutions are logged, including the encrypted password if you are substituting the password variable. You may see the following logs: debug apmd[3531]: 01490000:7: Util.cpp func: "ScanReplaceSessionVar()" line: 608 Msg: data: '%{session.logon.last.password}' start_pos: 0, count: 30 on 'session.logon.last.password' with the encrypted password logged

Conditions:
APM Access Policy log level set to debug, and session variable substitution is performed.

Impact:
Session variable substitution should not be logged, even if it is secure.

Workaround:
Set log level to informational or notice for normal operations. Logging at debug level is not recommended unless absolutely needed for specific troubleshooting as it adversely affects system performance.

Fix:
Session variable substitutions are no longer logged.


586131-3 : SSLv3 vulnerability CVE-2014-3566

Solution Article: K15702


586006-3 : Failed to retrieve CRLDP list from client certificate if DirName type is present

Component: Access Policy Manager

Symptoms:
Client certification revocation check will fail.

Conditions:
Two conditions will trigger this problem:
1. A CRLDP agent is configured in the access policy without server hostname and port, which is needed for DirName type processing. AND
2. At least one DirName type CRLDP is present in the client certification and it is the first in the list.

Impact:
Users may fail access policy evaluation when client certification is used.

Workaround:
Configure an LDAP server for the CRLDP object. It need not return a valid CRL.


585562-1 : VMware View HTML5 client shipped with Horizon 7 does not work through BIG-IP APM in Chrome/Safari

Component: Access Policy Manager

Symptoms:
When using Google Chrome or Safari (WebKit-based) browser to launch VMware View HTML5 client for Horizon 7 from APM webtop, this attempt fails with a blank screen in place of remote desktop session.

Conditions:
-- BIG-IP APM configured as PCoIP proxy for Horizon 7.
-- APM webtop in which the HTML5 client is used to launch a remote desktop.

Impact:
Cannot use HTML5 client. Only native client (Horizon View client) is available.

Workaround:
when HTTP_REQUEST {
    if { [HTTP::header "Origin"] ne "" } {
        HTTP::header remove "Origin"
    }
}

Fix:
VMware View HTML5 client shipped with Horizon 7 now work sthrough BIG-IP APM in Chrome/Safari.


585485-4 : inter-ability with "delete IPSEC-SA" between AZURE, ASA, and the BIG-IP system

Component: TMOS

Symptoms:
Some IKEv1 IPsec vendor implementations (for example Cisco ASA) send a delete SPI message for an IPsec-SA and expect that the sibling IPsec-SA (the SPI in the other direction) will also be deleted by the peer.

The BIG-IP system sends and expect messages with two SPI's inside.

Conditions:
An IPsec tunnel between a BIG-IP system and some other vendor may experience this. Azure and Cisco ASA are two such vendors.

Impact:
An IPsec tunnel goes down and in some situations may not renegotiate while the BIG-IP believes that the outgoing SPI is still active. The tunnel will stay down until the lifetime of the outbound SA expires.

Workaround:
Delete the outbound SA from the BIG-IP using the tmsh command by specifying the related SA:

(tmos)# delete net ipsec ipsec-sa ?
Properties:
  "{" Optional delimiter
  dst-addr Specifies the destination address of the security associations
  spi Specifies the SPI of the security associations
  src-addr Specifies the source address of the security associations
  traffic-selector Specifies the name of the traffic selector

Fix:
The BIG-IP system will remove both SAs associated with one traffic-selector (tunnel) when the peer sends a delete SPI message.


585424-3 : Mozilla NSS vulnerability CVE-2016-1979

Solution Article: K20145801


585412-2 : SMTPS virtual server with activation-mode allow will RST non-TLS connections with Email bodies with very long lines

Component: Local Traffic Manager

Symptoms:
Connections to a virtual server that uses an SMTPS profile may be reset with a reset cause of 'Out of memory.'

Conditions:
This might occur under the following conditions:
-- A virtual server that uses an SMTPS profile with activation-mode set to allow.
-- A client connection which does not use TLS that sends a DATA section with a text line that is longer than approximately 8192 characters.

8192 characters is an approximation for the maximum line length. The actual problem length can be affected by the MSS value and the particular way that the TCP traffic is segmented.

Impact:
The TCP connection is reset with a reset-cause of Out of memory' and the email will not be delivered.

Workaround:
None.

Fix:
A virtual server that uses an SMTPS profile with activation-mode set to allow no longer resets connections when the client does not use STARTTLS and the email body contains very long lines.


585097-3 : Traffic Group score formula does not result in unique values.

Component: TMOS

Symptoms:
In certain configurations, the Traffic Group score for a particular Traffic Group can be identical across devices in a device service cluster, resulting in the Traffic Group becoming Active on more than one device simultaneously.

Conditions:
The score is derived from the management-ip and other factors. If the device management-ips are not on the same /24 subnet, the score is not guaranteed to be unique.

The score can be observed with the tmsh "run cm watch_trafficgroup_device" command, and in some versions of BIG-IP, the "show cm traffic-group" command.

Impact:
When the problem occurs, Traffic Groups will be Active on multiple devices simultaneously. The problem can affect all Traffic Groups.

Workaround:
The only solution is to change the management-ip on one of the colliding devices. The workaround is not practical with DHCP, and in many other situations.

Fix:
The Active device selection logic has been changed to deterministically choose the Active device location, even in cases with identical static scores.


584373-3 : AD/LDAP resource group mapping table controls are not accessible sometimes

Component: Access Policy Manager

Symptoms:
AD/LDAP resource group mapping
In case of both lengthy group names and resource names edit link and control buttons could disapper under dialogue bounds

Conditions:
very long group names and resource names

Impact:
Impossible to delete and move rows in table - still possible to edit tho.

Workaround:
Spread one assign thru multiple rows

Fix:
Scroll bar is appearing when needed


584029-2 : Fragmented packets may cause tmm to core under heavy load

Component: Local Traffic Manager

Symptoms:
In rare circumstances, the Traffic Management Microkernel (TMM) process may produce a core file while processing fragmented packets.

As a result of this issue, you may encounter one or more of the following symptoms:

-- TMM generates a core file in the /shared/core directory.
-- In one of the /var/log/tmm log files, you observe an error message similar to the following example:
 notice panic: ../base/flow_fwd.c:255: Assertion "ffwd flag set" failed.
 panic: ../net/packet.c:168: Assertion "packet is locked by a driver" failed.

notice ** SIGFPE **

Conditions:
This issue occurs when all of the following conditions are met:

-- The TMM process offloads a fragmented packet by way of an ffwd operation.
-- Your BIG-IP system is under heavy load.

Impact:
The BIG-IP system temporarily fails to process traffic while the TMM process restarts. If the BIG-IP system is configured for high availability (HA), the system fails over to a peer system.

Workaround:
None.

Fix:
Fragmented packets no longer cause tmm to core under heavy load.


583957-4 : The TMM may hang handling pipelined HTTP requests with certain iRule commands.

Component: Local Traffic Manager

Symptoms:
Rarely, the TMM may hang during a HTTP::respond or HTTP::redirect iRule command if it is part of a pipelined HTTP request.

Conditions:
A HTTP::respond or HTTP::redirect iRule is used.
The iRule command is in an event triggered on the client-side.
A pipelined HTTP request is being handled.

Impact:
The TMM will be restarted by SOD.

Fix:
The TMM no longer hangs in rare situations when processing a pipelined HTTP request and invoking a HTTP::respond or HTTP::redirect iRule command.


583936-3 : Removing ECMP route from BGP does not clear route from NSM

Component: TMOS

Symptoms:
When configured to install multiple routes into the routing table, ZebOS does not withdraw BGP routes when a neighbor is shut down and it has more than two routes already installed for the same route prefix.

Conditions:
ECMP routing must be enabled and in-use.

Impact:
ECMP routes are not properly removed from the main routing table.

Fix:
Now properly removing ECMP routes from the routing table.


583686-3 : High ASCII meta-characters can be disallowed on UTF-8 policy via XML import

Component: Application Security Manager

Symptoms:
After importing an XML policy, you cannot view or edit policies containing high ASCII characters.

Conditions:
This occurs when importing XML policies containing high-ASCII meta-characters but high-ASCII is not allowed in a UTF-8 policy.

Impact:
Unable to view or edit the policy, and Illegal meta character in value violation is triggered


583516-3 : tmm ASSERT's "valid node" on Active, after timer fire..

Component: TMOS

Symptoms:
TMM crashes on ASSERT's "valid node".

Conditions:
The cause is unknown, and this happens rarely.

Impact:
tmm crash

Workaround:
no

Fix:
TMM no longer asserts on 'valid node'


583445 : Alert dashboard does not correctly display Hebrew characters in alerts.

Component: Fraud Protection Services

Symptoms:
Alert server cannot decrypt Hebrew characters in alerts.

Conditions:
Malicious script injection containing wide characters.

Impact:
Incorrectly displayed alerts in dashboard.

Workaround:
None.

Fix:
Alerts are sent encoded and are decoded in the dashboard.


583285-7 : BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.

Component: TMOS

Symptoms:
The BIG-IP system logs INVALID-SPI messages but does not remove the associated Security Associations (SAs) corresponding to the message. This is the second part of a fix provided for this issue. See fixes for bug 569236 for the first part.

Conditions:
This can occur if an IPsec peer deletes a phase2 (IPsec) SA and does not send a 'notify delete' message to the other peer. The INVALID-SPI message is most likely to be seen when the peer deletes an SA before the SA's agreed lifetime.

Impact:
If the BIG-IP is always the Initiator, the Responder will not initiate a new tunnel if the Responder only handles responses to the BIG-IP clients' traffic. The BIG-IP system continues to use the IPsec SA it believes to be still up. When an SA expires prematurely, some IPsec peers will reject an inbound SPI packet with an ISAKMP INVALID-SPI notify message. If the INVALID-SPI message does not cause new SAs to be created, there will be a tunnel outage until the SA lifetime expires on the defunct SA held on the BIG-IP system.

Workaround:
Manually remove the invalid SA on the BIG-IP system.

Fix:
Now, when the BIG-IP system receives INVALID-SPI messages, it deletes the invalid Security Association as well as logging the INVALID-SPI message, so the tunnel can initiate again. This is part two of a two-part fix. Fixes for bug 569236 provide part one of the fix.


583272-1 : "Corrupted Connect Error" when using IPv6 and On-Demand Cert Auth

Solution Article: K11736022

Component: Access Policy Manager

Symptoms:
Browser shows a "corrupted connect error" when access policy runs On-Demand Cert Auth on an IPv6 virtual server.

The root cause is that in packet capture, the APM sends an HTTP 302 with invalid brackets around the hostname, like this:
Location: https://[login.example.com]/my.policy

Brackets around IPv6 addresses are for raw IPv6 addresses. They are illegal for DNS names that represent an IPv6 address.

Conditions:
IPv6 virtual server, and On-Demand Cert Auth in the access policy. Only applies if a DNS hostname is used. Raw IPv6 addresses are not affected.

Impact:
Client is unable to authenticate.

Workaround:
None.

Fix:
The brackets in the Location header were inserted if the connection was IPv6, which included both raw IPv6 addresses and DNS names representing IPv6 addresses. The logic has been changed to only insert if the connection is to a raw IPv6 address.


583113-3 : NTLM Auth cannot be disabled in HTTP_PROXY_REQUEST event

Component: Access Policy Manager

Symptoms:
The following iRule did not work as expected when the access profile had an NTLM auth. The client still received a 407 prompt to enter NTLM credentials.

when HTTP_PROXY_REQUEST {
    if { [HTTP::uri] contains "disable" } {
        ACCESS::disable
    }
}

Conditions:
Access profile of an SWG type, with an NTLM auth profile attached.

Impact:
It was impossible to disable NTLM auth from the HTTP_PROXY_REQUEST event.

Workaround:
The following iRule works from HTTP_REQUEST

when HTTP_REQUEST {
    if { [HTTP::uri] contains "disable" } {
        ACCESS::disable
        ECA::disable
    }
}

Fix:
When ACCESS filter is disabled, it still processes certain messages. The logic in one of those message handlers was "if NTLM configured, then wake up the ECA plugin"

Fix changed the logic to "if NTLM configured and ACCESS filter is not disabled, then wake up the ECA plugin."


583010-9 : Sending a SIP invite with "tel" URI fails with a reset

Component: Service Provider

Symptoms:
Using a "INVITE tel:" URI results in SIP error (Illegal value).

Conditions:
Sending a SIP "INVITE tel:" to BIG-IP does not work.

Impact:
"INVITE tel:" messages are not accepted by BIG-IP.

Workaround:
None

Fix:
An EHF will be released to address this issue. It will also be addressed in a future release.


582813-1 : Linux Kernel CVE-2016-0774

Solution Article: K08440897


582752-2 : Macrocall could be topologically not connected with the rest of policy.

Component: Access Policy Manager

Symptoms:
It is possible to create macrocall access policy item that:

1. Belongs to policy items list.
2. Correctly connected to ending.
3. Have no incoming rules (i.e., no items pointing at it).

Conditions:
1. Create access policy with macrocall item in one of the branches.
2. Remove the item which refers to this macrocall item from AP

As a result, macrocall item remains.

Impact:
VPE fails to render this access policy.

Workaround:
Delete macrocall access policy item manually using tmsh commands.

Fix:
Any modification of access policy is not allowed if it makes any access policy item non-referenced.
At upgrade time, non-referenced access policy items are deleted. All subsequent access policy items are deleted as well. Resulting access policies can be rendered correctly by VPE. Note that only active configuration is corrected, saved configuration file (/config/bigip.conf) contains uncorrected version until any new configuration changes are done. Active configuration can be saved by explicit tmsh command ('tmsh save sys config partitions all").


582683-5 : xpath parser doesn't reset a namespace hash value between each and every scan

Component: Application Security Manager

Symptoms:
After a while the iRule event stops firing until the cbrd daemon is restarted.

Conditions:
The customer has a virtual server configured with an XML, along with an iRule that triggers on the XML_CONTENT_BASED_ROUTING event.

Impact:
XML content based routing does not work dependably.

Workaround:
N/A

Fix:
fixing xpath parer -- Restoring namespace declaration each time the xpath parser finishes to parse the document.


582526-2 : Unable to display and edit huge policies (more than 4000 elements)

Component: Access Policy Manager

Symptoms:
It takes a very long time or is not possible to display huge policies (more than 4000 elements). VPE returns server timeout error or simple halts.

Conditions:
Huge Access Policy, for example, containing 4000 or more elements.

Impact:
Unable to edit policy because VPE times out.

Workaround:
None.

Fix:
VPE loading times for APM policies is greatly improved, so displaying very large policies (for example, 4000 elements) now completes successfully.


582440-2 : Linux client does not restore route to the default GW on Ubuntu 15.10

Component: Access Policy Manager

Symptoms:
Default route may be deleted after network access connection is deleted on Linux Ubuntu 15.10 distribution.

Conditions:
Ubuntu 15.10, network access tunnel connect and then disconnect

Impact:
User will not be able to reach internet after disconnecting from network access.

Workaround:
If Wifi is in use then turn off and on again.
If Ethernet is used then unplugging and plugging cable again should solve the problem.


582029-1 : AVR might report incorrect statistics when used together with other modules.

Component: Application Visibility and Reporting

Symptoms:
When AVR is assigned to a virtual server that also has APM or Behavioral DoS, it can lead to AVR getting false readings of the activity and as result report on unexpectedly large numbers.

Conditions:
AVR Module is used together with other modules, and these module affect the traffic flow.

Impact:
AVR reports incorrect statistics: unexpectedly large numbers.

Workaround:
None.

Fix:
AVR now identifies the other modules' activity and collects the activity statistics accordingly.


582003-2 : BD crash on startup or on XML configuration change

Component: Application Security Manager

Symptoms:
BD crash.
out of memory XML message in the bd.log.
The BD doesn't startup and keeps crashing upon startup.

Conditions:
Many XML profiles and relatively large XML configuration.

Impact:
ASM down, machine is offline.

Workaround:
Increase the XML available memory.

Fix:
Fixed an XML memory sanity test that caused a crash when out of XML memory upon reading XML configuration.


581840 : Cannot manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.

Component: Device Management

Symptoms:
If trying to manage a BIG-IP version 11.6.1 or 11.6.1 HF1 with an administrator account named other than “admin”, this can fail.

Conditions:
This can occur with a BIG-IQ managing a BIG-IP version 11.6.1 or 11.6.1HF1 system with a different account than “admin”.

Impact:
You cannot manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.

Workaround:
Install 11.6.1 HF2 on the BIG-IP system, or use an administrator account named “admin” for managing the device.

Fix:
Can now manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.

Behavior Change:
local requests through iControl client are now made on port 80, instead of 443.


581835-3 : Command failing: tmsh show ltm virtual vs_name detail.

Component: TMOS

Symptoms:
The following command fails: tmsh show ltm virtual vs_name detail. The system posts the following error:

01020036:3: The requested profile exchange: virtual server object (exchange_profile_name:vs_name) was not found.

Conditions:
Occurs when an APM Access Profile has an Exchange Profile attached and the access profile is then assigned to a virtual server.

Impact:
No information is displayed by the tmsh show command.

Workaround:
None.

Fix:
The tmsh show command now presents information, and 'tmsh show ltm virtual vs_name detail' shows the expected details without error.


581834-4 : Firefox signed plugin for VPN, Endpoint Check, etc

Component: Access Policy Manager

Symptoms:
clients are unable to use the Firefox plugin on Firefox version 47 and above

Conditions:
Clients using Firefox v47 and above attempting to use the Firefox plugin

Impact:
Clients will be unable to use the plugin if they are using Firefox version 47 and above

Fix:
The Firefox plugin now supports all versions.


581829-1 : Traffic that uses a network HSM for crypto services can fail to recover.

Component: Local Traffic Manager

Symptoms:
When the system is configured to use network HSM for FIPS crypto services, all FIPS-related traffic will cease to function after the tmm daemon gets restarted, and does not recover until a restart of both pkcs11d and tmm, or a reboot of the unit.

Conditions:
-- System is configured for network HSM for FIPS crypto services.
-- tmm gets restarted.

Impact:
Traffic that relies on the network HSM for crypto services fails and does not recover.

Workaround:
Restart both pkcs11d and tmm by issuing the following command:

On a standard BIG-IP appliance:
 bigstart restart pkcs11d tmm

On a VIPRION system:
 clsh bigstart restart pkcs11d tmm

Fix:
Traffic that relies on the network HSM for FIPS crypto services now recovers as expected when tmm is restarted.


581770-2 : Network Access traffic does not pass IPv6 traffic if a Network Access resource contains IPv4&IPv6

Component: Access Policy Manager

Symptoms:
Network Access clients are unable to pass IPv6 traffic

Conditions:
Network Access resource configured with IPv4&IPv6
Client attempts to pass IPv6 traffic

Impact:
IPv6 traffic is dropped

Fix:
APM will now pass IPv6 traffic through the tunnel if an IPv4&IPv6 resource is configured.


580893-1 : Support for Single FQDN usage with Citrix Storefront Integration mode

Solution Article: K08731969

Component: Access Policy Manager

Symptoms:
Adding a new login account onto Citrix Receiver enumerates the applications and desktop. Logging off and reconnecting using the same account starts failing.

Conditions:
-- Citrix Storefront Integration mode with APM.
-- Using the same FQDN to access both Storefront as well as an APM virtual server.

Impact:
Clients are unable to connect.

Workaround:
No workaround other than using different FQDNs.

Fix:
You can now use the same FQDN to successfully access both Storefront as well as an APM virtual server.


580817-3 : Edge Client may crash after upgrade

Component: Access Policy Manager

Symptoms:
The Edge client may crash after upgrading to 11.4.1 through 12.0.0.

Conditions:
Access Policy with Firewall Checker
Update BIG-IP to 12.1.0

Impact:
Users are unable to use the Edge client

Fix:
Fixed a crash in the Edge client


580686-1 : Hostagentd might leak memory on vCMP hosts.

Solution Article: K70973444

Component: Device Management

Symptoms:
hostagentd resident memory keeps leaking over time. Unexplained system instability. Health monitors might work intermittently.

Conditions:
This occurs when host uptime is two months or longer.

Impact:
hostagentd consumes more than 400 MB of resident memory. In some cases, the process consumes more than 1 GB. This might cause system instability and intensive usage of vCMP host swap memory.

Workaround:
Restart hostagentd on vCMP host.

Fix:
Many stability and other improvements have been made to hostagentd daemon and associated functionality, so that memory leaks on vCMP hosts no longer occur.


580596-9 : TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 / TMM SSL/TLS virtual server vulnerability CVE-2016-6907

Solution Article: K14190 K39508724


580460-1 : Client side integrity defense or proactive may break application

Component: Advanced Firewall Manager

Symptoms:
A blank page is shown when client side integrity/proactive is turned on.

Conditions:
1. Client side integrity/proactive is turned on
2. IE 11 in compatibility mode - version 8 or lower. IE6 and 7 work.

Impact:
Application is broken - blank page is shown

Workaround:
N/A


580429-5 : CTU does not show second Class ID for InstallerControll.dll

Component: Access Policy Manager

Symptoms:
Client troubleshooting utility does not display the registered class id of Installer control.dll.

Conditions:
Client troubleshooting utility is used to display all installed edge client components.

Impact:
No impact to end user or administrator. Impacts F5 support.

Workaround:
None.

Fix:
CTU now shows the class id of installer control.dll.


580421-3 : Edge Client may not register DLLs correctly

Component: Access Policy Manager

Symptoms:
After an end-user confirms that they want to install InstallerControll.cab, the browser gets stuck in 'Checking client'.

Conditions:
Client is using Internet Explorer

Impact:
Clients are unable to install the Edge client components

Fix:
Edge client components are now getting properly registered.


580340-3 : OpenSSL vulnerability CVE-2016-2842

Solution Article: K52349521


580313-3 : OpenSSL vulnerability CVE-2016-0799

Solution Article: K22334603


580303-3 : When going from active to offline, tmm might send a GARP for a floating address.

Component: Local Traffic Manager

Symptoms:
When moving from active to offline, tmm might send one final GARP for a floating address from the device that is moving offline.

Conditions:
Using high availability, and switching a device from active to offline.

Impact:
The GARP from the offline device can arrive on upstream devices after the GARP from the newly active device, which might poison the address cache of the upstream device. The result is that failover takes longer, since the upstream devices must rediscover the active device.

Workaround:
Use MAC masquerading along with the floating address; the system sends a GARP for the MAC masqueraded address, which prevents the issue.

Fix:
tmm no longer sends a final GARP for a floating address immediately before going offline.


580168-2 : Information missing from ASM event logs after a switchboot and switchboot back

Component: Application Security Manager

Symptoms:
Information missing from ASM event logs after a switchboot and switchboot back

Conditions:
ASM provisioned
event logs available with violation details
install/upgrade to another volume and switchboot to it
wait for ASM to fully come up
switchboot back
event logs are still available but violation details are gone

Impact:
Information missing from ASM event logs after a switchboot and switchboot back

Workaround:
N/A

Fix:
N/A


580026-3 : HSM logging error

Solution Article: K74759095


579975-3 : OpenSSL vulnerability

Solution Article: K79215841


579955-2 : BIG-IP SPDY and HTTP/2 profile vulnerability CVE-2016-7475

Solution Article: K01587042


579919-1 : TMM may core when LSN translation is enabled

Component: Local Traffic Manager

Symptoms:
tmm core

Conditions:
Virtual uses LSN translation with a destination matching a pool-based route

Impact:
Traffic disrupted while tmm restarts.

Fix:
Virtual with LSN translation no longer leads tmm coring when destination matches a pool-based route.


579909-2 : Secondary MCPD exits for APM Sandbox warning improperly treated as configuration error

Component: Access Policy Manager

Symptoms:
Secondary blade MCPD exits if APM Sandbox intends to log a warning message when it fails to remove the corresponding sandbox directory /var/sam/www/webtop/sandbox/files_d/<partition_name>_d while the user is removing the partition.

There are multiple cases that can potentially log such kind of Sandbox warning message and cause an mcpd crash and/or tmm crash. APM can log the warning if it encounters a directory which is not empty, or if the directory does not exist. You will see this error signature in /var/log/ltm:

Mar 11 11:36:49 slot2/viprion-3 warning mcpd[6022]: 010717ac:4: Configuration Warning: Cannot remove directory with symlink to sandbox for partition (p1). Error: Directory not empty. If you have access to bash shell, try to run command: rmdir /var/sam/www/webtop/sandbox/files_d/p1_d/

Conditions:
The sandbox directory corresponding to the partition that you are deleting cannot be removed due to any reason such as Not Existing, Not Empty, etc. on the secondary blade. This can occur on the secondary blades if you create a partition before provisioning APM, then delete the partition on the primary blade, and auto-sync is enabled in the device group.

Impact:
Secondary MCPD exits and blade restarts. Tmm can core. Traffic disrupted while tmm restarts.

Workaround:
N/A

Fix:
Fixed such that Secondary MCP will not exit but only log the warning message as the partition is successfully deleted.


579843-3 : tmrouted may not re-announce routes after a specific succession of failover states

Component: Local Traffic Manager

Symptoms:
tmrouted does not re-announce RHI routes in a specific transition of failover states within a HA pair using dynamic routing and HA pair.

Conditions:
- Active/Standby HA pair set up
 - Both units configured with a dynamic routing protocol and Route Health Injection enabled on one or more Virtual-Addresses.
 - Active unit has the following succession of failover states:
   Active->Offline->Online->Standby->Active

Impact:
Tmrouted may not announce the Virtual addresses when coming back to Active state after the mention succession.

Workaround:
A failover to Standby and back to Active works around the issue.
Restarting tmrouted is also an alternative option.

Fix:
tmrouted now re-announces RHI routes in a specific transition of failover states within a HA pair using dynamic routing and HA pair.


579829-3 : OpenSSL vulnerability CVE-2016-0702

Solution Article: K79215841


579559-2 : DTLS Networks Access may not work with some hardware platforms with Nitrox hardware acceleration

Component: Access Policy Manager

Symptoms:
Network Access always fallbacks to TLS connection even if DTLS is configured when connecting to some hardware platforms.

Conditions:
Network Access is configured to use DTLS
Hardware BIG-IP with DTLS Nitrox acceleration is used,

Impact:
Network Access connection always fallbacks to TLS connection

Workaround:
N/A

Fix:
Previously, Network Access always fell back to a TLS connection even if DTLS was configured when connecting to some hardware platforms. Network Access no longer falls back to TLS.


579524-2 : DBD::mysql::db do failed: Duplicate entry '/Common/xxx' for key 'name'

Component: Application Security Manager

Symptoms:
Policy Import via iControl REST in an HA pair occasionally fails on the Standby device with - DBD::mysql::db do failed: Duplicate entry '/Common/xxx' for key 'name'

Conditions:
Active/Standby pair configured
ASM provisioned
Import a security policy, via iControl REST

Impact:
Policy import fails

Workaround:
n/a

Fix:
We have fixed the import policy via iControl REST so that it does not generate the database error


579371-2 : BIG-IP may generate ARPs after transition to standby

Solution Article: K70126130

Component: Local Traffic Manager

Symptoms:
tmm generates unexpected ARPs after entering standby.

Conditions:
-- High availability configuration with a vlangroup with bridge-in-standby disabled.
-- ARP is received just before transition to standby.

Impact:
Unexpected ARP requests that might result in packet loops.

Workaround:
None.

Fix:
ARPs will no longer be proxied on vlangroups with bridge-in-standby disabled after entering standby.


579284 : Potential memory corruption in MCPd

Component: TMOS

Symptoms:
Memory in mcpd could get corrupted. The effect of this is unpredictable.

Conditions:
Varies. One way (but not the only way) this could be seen is by cancelling a chunked stats query (e.g. hitting ctrl-c during "show sys connection").

Impact:
Varies. Sometimes nothing will happen; other times MCP could start acting unpredictably. In one case it closed its connection to TMM, which caused all TMMs to restart.

Fix:
Identified and fixed areas of potential memory corruption in MCP.


579237-3 : OpenSSL Vulnerability CVE-2016-0705

Solution Article: K93122894


579220-3 : Mozilla NSS vulnerability CVE-2016-1950

Solution Article: K91100352


579085-4 : OpenSSL vulnerability CVE-2016-0797

Solution Article: K40524634


579049-1 : TMM core due to wrong assert

Component: Application Visibility and Reporting

Symptoms:
Under stress traffic tmm can core with the following backtrace:
frame 3:
in *__GI___assert_fail
frame 4 will look like this:
.... avr_alloc_segmempool_with_id .. mempool.c:278

Conditions:
AVR provision and collecting statistic.

Impact:
Traffic disrupted while tmm restarts.

Fix:
Fixed an issue that intermittently caused the TMM to core.


578971-1 : When mcpd is restarted on a blade, cluster members may be temporarily marked as failed

Component: Local Traffic Manager

Symptoms:
When mcpd is restarted on a blade, the clusterd process on that blade may become blocked for some time. This may result in cluster member heartbeat timeouts, which are seen in the /var/log/ltm log file with messages that include:

"Slot 1 suffered heartbeat timeout ..."

This causes cluster members to be marked failed. The condition resolves itself within one minute, and the cluster fully recovers on its own.

Conditions:
Mcpd is restarted on a blade.

Impact:
Though all blades recover on their own, the cluster members being marked fail may result in a failover.

Workaround:
There is no workaround for this issue. It is recommended to avoid restarting mcpd on any blade belonging to the active unit of an HA group. The issue resolves itself within about a minute, and all cluster members will be marked as up again.

Fix:
The clusterd daemon has been fixed to no longer become blocked when mcpd is restarted. This prevents the cluster member heartbeat timeouts from occurring, and thus no cluster members will be marked failed.


578844-2 : tmm cores when switching to IPv6 virtual server while connected to IPv4 virtual server with Edge Client.

Component: Access Policy Manager

Symptoms:
tmm cores when switching to IPv6 virtual server while connected to IPv4 virtual server with Edge Client.

Conditions:
NA resource with IPv4&IPv6 is used (SNAT pool in NA resource is set to None). User is connected to IPv4 Virtual server.
While connected user clicks on 'Change server' and chooses an IPv6 virtual server.

Impact:
Traffic disrupted while tmm restarts.


578570-2 : OpenSSL Vulnerability CVE-2016-0705

Solution Article: K93122894


578564-3 : ICAP: Client RST when HTTP::respond in HTTP_RESPONSE_RELEASE after ICAP REQMOD returned HTTP response

Component: Service Provider

Symptoms:
Connection aborted with RST "ADAPT unexpected state transition (old_state 22 event 7)"

Conditions:
An HTTP virtual has a request-adapt profile.
The ICAP server returns an HTTP response for REQMOD.
An iRule executes HTTP::respond in the HTTP_RESPONSE_RELEASE event.

Impact:
HTTP::respond cannot be used to modify an HTTP response returned by an ICAP server that is modifying an HTTP request.

Fix:
HTTP::respond works as expected even on an HTTP response returned by an ICAP server after request adaption.


578353 : Statistics data aggregation process is not optimized

Component: Application Visibility and Reporting

Symptoms:
CPU spikes may occur every 5 minutes

Conditions:
Occurs all the time

Impact:
High CPU usage may be observed every 5 minutes

Workaround:
For versions based on 11.5.4 and 11.6.0 take the following steps:

1. Edit the entry 'AggregationMode' under the /etc/avr/monpd/monpd.cfg file and set it to be 'low' instead of 'medium' or 'high'.

2.Restart Monpd afterwards.

For 12.0.0 and on:
tmsh modify sys db avr.stats.aggregation value low

Fix:
The aggregation process of statistics in DB which is done using monpd should be optimized, and skip redundant updates of tables.


578334-3 : Policy Import (REST, inline XML import) in HA pair (CMI) fails on the peer device, remaining with a stub (default) policy.

Component: Application Security Manager

Symptoms:
These errors are visible in asm log:
--------------------
Mar 3 20:18:33 Bip_102 crit g_server.pl[29381]: 01310027:2: ASM subsystem error (asm_config_server.pl,F5::ImportExportPolicy::Base::fatal_error): no such file '/ts/var/sync/admin~t6jsI8OQtyjKrbs2Djpjng'
Mar 3 20:18:33 Bip_102 info perl[29340]: 01310053:6: ASMConfig change: Import Policy Task Import Policy Task (1457029113.860000) [update]: Status was set to FAILURE. End Time was set to 1457029114. Message was set to Exported policy file not found!.. { audit: username = admin, client IP = 172.18.185.226 }
--------------------

The policy created on the peer device is a stub - default policy.

Conditions:
ASM provisioned
HA pair (CMI)
Policy Import (REST, inline XML import)

Impact:
Policy Import (REST, inline XML import) in HA pair (CMI) fails on the peer device, remaining with a stub (default) policy on the peer device.

Workaround:
n/a

Fix:
We have fixed the import/export mechanism on HA pair (CMI).


577939-1 : DNS suffixes on user's machine may not be restored correctly in some cases

Component: Access Policy Manager

Symptoms:
DNS suffixes on user's may not be restored correctly if user reboots his machine without disconnecting VPN.

This may result in incorrect or failed DNS resolution.

Conditions:
1)DNS relay proxy components is installed on user's machine
2) User reboots the machine without disconnecting VPN first

Impact:
DNS suffixes are not restored correctly, which may lead to incorrect or failed DNS resolution

Workaround:
Disconnect VPN before rebooting machine

Fix:
DNS Suffixes are now restored properly.


577863-2 : DHCP relay not forwarding server DHCPOFFER and DHCPACK message after sometime

Component: Policy Enforcement Manager

Symptoms:
If routing table on DHCP server is mis-configured, so that DHCP server know how to send packets to BigIP selfIP(used by BigIP DHCP relay), but does not know how to send packets to DHCP clients, DCHP client will not receive DHCP reply for unicast request and will start to broadcast DHCP renewal. After a while, BigIP will stop to relay DHCPOFFER and DHCPACK back to DHCP clients all together.

Conditions:
DHCP server unicast reply back to client is not received by client, causing DHCP client to send broadcast DHCP packets(with client's IP as source IP).

Impact:
BigIP will stop to relay DHCPOFFER and DHCPACK back
to DHCP clients

Workaround:
Fix the DHCP server routing table, so that DHCP server can deliver DHCP reply packet back to client successfully.


577828-5 : BIND vulnerability CVE-2016-2088

Solution Article: K59692558


577826-4 : BIND vulnerability CVE-2016-1286

Solution Article: K62012529


577823-4 : BIND vulnerability CVE-2016-1285

Solution Article: K46264120


577814-4 : MCPd might leak memory in PEM stats queries.

Component: Policy Enforcement Manager

Symptoms:
Memory leak may result in an "Out of Memory" condition causing functional issues in the BIG-IP.

Conditions:
Occurs when a valid PEM stats query is issued by a UI (GUI TMSH, REST, etc.) and PEM is configured on the BIG-IP.

Impact:
System may be unresponsive or crash due to being out of memory.

Workaround:
None.

Fix:
Fixed the potential MCPd memory leak in PEM stats queries.


577668-1 : ASM Remote logger doesn't log 64 KB request.

Component: Application Security Manager

Symptoms:
A request longer than 10 KB is truncated to 10 KB in the ASM remote logger although the remote logger is configured to log up to 64 KB requests.

Conditions:
The remote logger is configured to max request size 64k .
A request is longer than 10 KB.

Impact:
Incorrect request size in the log.

Workaround:
N/A

Fix:
ASM can now logs up to 64 KB requests. (Actual size depends on the total message size and the other fields in the message.)


577664-2 : Policy import, to inactive policies list, results in different policies on the sync-failover peers

Component: Application Security Manager

Symptoms:
Having a standard Active/Standby setup, with a single Sync-Failover DG, Auto-Sync, with ASM enabled.
When importing an ASM policy (named "ddddd") into the inactive policies list, the following results in GUI at -
"Security ›› Application Security : Security Policies : Inactive Policies"

On active device:
Security Policy Name - Version
ddddd - 2016-02-25 10:39:49
ddddd_2 - 2016-03-01 00:11:46

On standby device:
Security Policy Name - Version
ddddd - 2016-03-01 00:11:41
ddddd_2 - 2016-02-25 10:39:49

According to the "Version" field (time stamps), the "ddddd" on active is actually "ddddd_2" on standby and then the other two policies are not the same.

The group ends up with three different policies on the two devices.

Conditions:
Active/Standby pair
ASM provisioned
Import security policy to the inactive policies list

Impact:
Three different policies are created on the two devices.

Workaround:
n/a

Fix:
We have fixed the import policy process so that it results in consistent state on both devices in a device group.


577440-1 : audit logs may show connection to hagel.mnet

Component: TMOS

Symptoms:
An iControl host header is improperly formatted with the name hagal.mnet

The request is properly delivered to the correct host but contains a badly addressed host header that is ignored.

If the authorization fails for the icontrol query then the audit log will contain this destination information which may be confusing.

Conditions:
Setting up device trust exercises this code path.

Impact:
No impact to functionality but is confusing for log interpretation.

Workaround:
There is not workaround

Fix:
When this bug is fixed then the host header is properly formatted with the destination of the iControl request.


576591-4 : Support for some future credit card number ranges

Component: Application Security Manager

Symptoms:
ASM does not block or mask when a specific credit card number range (planned for the future) appears in the response.

Conditions:
The Data Guard feature is turned on and set to Block, Alarm or Mask. The responses contains credit card number with specific ranges.

Impact:
The traffic passes unmasked or unblocked to the end client.

Workaround:
A custom pattern is possible for these cases, but should be adjusted to each customer specifically.


576314-2 : SNMP traps for FIPS device fault inconsistent among versions.

Component: Local Traffic Manager

Symptoms:
The snmp traps bigipFipsDeviceError and bigipFipsFault are inconsistent among versions.

Conditions:
This trap is raised if the FIPS device firmware has stopped responding to requests and is no longer functional. The trap is different on the BIG-IP 10350 FIPS platform.

Impact:
The meaning of the trap is that the system is not able to perform any FIPS operations and process FIPS related traffic. You will need to be mindful of which version you are on to interpret the OIDs correctly.

Fix:
An SNMP trap is generated when the system has detected a FIPS device fault indicating that said device can no longer service FIPS operations. The OIDs are different across versions and one specific platform. Here is the OIDs and versions:

BIGIP-COMMON-MIB::bigipFipsDeviceError .1.3.6.1.4.1.3375.2.4.0.152
This trap means "Encountered error in the FIPS card operation" on all FIPS platforms

BIGIP-COMMON-MIB::bigipFipsFault .1.3.6.1.4.1.3375.2.4.0.156 (from v11.5.4-hf1 and 11.6.1, not 12.0.0)
BIGIP-COMMON-MIB::bigipFipsFault .1.3.6.1.4.1.3375.2.4.0.166 (from v12.1.0)
These traps mean "The FIPS card is currently in faulty state" for the specific FIPS hardware included on the BIG-IP 10350


576305-3 : Potential MCPd leak in IPSEC SPD stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying IPSEC SPD stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IPSEC SPD stats.


576296-2 : MCPd might leak memory in SCTP profile stats query.

Component: Local Traffic Manager

Symptoms:
The memory allocation for mcpd might grow by a small amount if SCTP profile stats are queried. In order to begin to impact the performance of the system, the stats would have to be queried many thousands of times.

Conditions:
An SCTP profile is configured, and the stats are displayed in TMSH or the GUI.

Impact:
Performance may be degraded.

Workaround:
None.

Fix:
Resolved a memory leak in mcpd resulting from a query of SCTP profile stats.


576224-1 : NetHSM does not come back after TCP connection to device is reset

Component: Local Traffic Manager

Symptoms:
NetHSM does not come back after TCP connection to device is reset.

Conditions:
TCP connection to NetHSM device is reset.

Impact:
NetHSM stops working.

Workaround:
None.

Fix:
NetHSM connectivity is restored after TCP connection to device is reset.


576069-2 : Rewrite can crash in some rare corner cases

Component: Access Policy Manager

Symptoms:
Rewrite can crash in some rare corner cases when some specific erroneous elements are present in an HTML content.

Conditions:
Any of the strings:

<meta http-equiv="refresh" />
<meta http-equiv="location" />
<param name="general_servername" />
<param name="wmode" />

triggers guaranteed rewrite crash.

Impact:
Web application malfunction.

Workaround:
iRule or direct fix of improper HTML tag.

Fix:
Fixed.


575735-2 : Potential MCPd leak in global CPU info stats code

Component: TMOS

Symptoms:
MCPd leaks memory; the umem_alloc_8 cache will grow.

Conditions:
In some cases, querying global CPU information stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying global CPU information stats.


575726-2 : MCPd might leak memory in vCMP interface stats.

Component: TMOS

Symptoms:
MCPd might leak memory in vCMP interface stats.

Conditions:
The memory leak occurs when viewing VCMP interface statistics.

Impact:
Over time this can cause MCPd to run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying vCMP interface stats.


575716-2 : MCPd might leak memory in VCMP base stats.

Component: TMOS

Symptoms:
MCPd might leak memory in VCMP base stats.

Conditions:
This occurs when looking at VCMP base statistics.

Impact:
Over time this might cause MCPd to run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying VCMP base stats.


575708-2 : MCPd might leak memory in CPU info stats.

Component: TMOS

Symptoms:
MCPd might leak memory in CPU info stats.

Conditions:
In some cases, querying CPU information stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying CPU information stats.


575671-2 : MCPd might leak memory in host info stats.

Component: TMOS

Symptoms:
MCPd might leak memory in host info stats.

Conditions:
In some cases, querying host information stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying host information stats.


575660-2 : Potential MCPd leak in TMM rollup stats stats

Solution Article: K50219995

Component: TMOS

Symptoms:
MCPd leaks memory so the amount of used memory will grow over time.

Conditions:
In rare cases, such as immediately after a reboot before system performance stats are populated, querying system performance stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying system performance stats.


575649-2 : MCPd might leak memory in IPFIX destination stats query

Component: TMOS

Symptoms:
MCPd might leak memory in IPFIX destination stats query.

Conditions:
In some cases, querying IPFIX destination stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IPFIX destination stats.


575631-3 : Potential MCPd leak in WAM stats query code

Component: WebAccelerator

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying WAM stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying WAM stats.


575626 : Minor memory leak in DNS Express stats error conditions

Solution Article: K04672803

Component: Local Traffic Manager

Symptoms:
A minor memory leak might occur in certain error conditions relating to DNS Express statistics.

Conditions:
There are no known DNS Express configurations that lead to this issue. The problem was detected through standard code review practices.

Impact:
Memory leaks might eventually lead to system reboots.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur in certain error conditions relating to DNS Express statistics.


575619-2 : Potential MCPd leak in pool member stats query code

Component: TMOS

Symptoms:
MCPd leaks memory; the umem_alloc_8 cache will grow.

Conditions:
In some cases, querying pool member stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying pool member stats.


575612-3 : Potential MCPd leak in policy action stats query code

Component: Local Traffic Manager

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying policy action stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying policy action stats.


575609-3 : Zlib accelerated compression can result in a dropped flow.

Component: Access Policy Manager

Symptoms:
Some compression requests would fail when the estimated compression output block was too small. Such errors deposit an error in the log similar to: Device error: n3-compress0 Zip engine ctx eviction (comp_code=2): ctx dropped.

Conditions:
A block that will not compress can generate a compression output that exceeds the estimated output block size.

Impact:
The flow that encounters the error is dropped.

Workaround:
Disable hardware accelerated compression.

Fix:
Difficult to compress requests may be dropped.


575608-2 : MCPd might leak memory in virtual server stats query.

Component: TMOS

Symptoms:
MCPd might leak memory in virtual server stats query.

Conditions:
In some cases, querying virtual server stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying virtual server stats.


575595-1 : Potential MCPd leak in eviction policy stats.

Component: TMOS

Symptoms:
The memory allocation for mcpd will grow by a small amount if a eviction policy stats are queried. In order to begin to impact the performance of the system, the stats would have to be queried many thousands of times.

Conditions:
An eviction policy is configured, and the stats are displayed in TMSH or the GUI.

Impact:
Performance may be degraded.

Fix:
Resolved a memory leak in mcpd resulting from a query of eviction policy stats.


575591-2 : Potential MCPd leak in IKE message stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying IKE message stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IKE message stats.


575589-1 : Potential MCPd leak in IKE event stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying IKE event stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IKE event stats.


575587-2 : Potential MCPd leak in BWC policy class stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying BWC policy stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying BWC policy stats.


575571-2 : MCPd might leak memory in FW DOS SIP attack stats query.

Component: Advanced Firewall Manager

Symptoms:
MCPd might leak memory in FW DOS SIP attack stats query.

Conditions:
This occurs when looking at firewall DOS SIP stats.

Impact:
Over time this can cause MCPd to run out of memory and core.


575499-1 : VPN filter may leave renew_lease timer active after teardown

Component: Access Policy Manager

Symptoms:
TMM core making the system unavailable for a period of time until it comes back up.

Conditions:
When using both IPv4 & IPv6 network access resources with static IP address for IPv4 and dynamic address assignment for IPv6 tmm will core while NA tunnel is running or on NA's disconnect time.

Impact:
TMM core and bring down the system.

Workaround:
N/A

Fix:
No more stale renew_lease timer in vpn_ctx to cause TMM core.


575347-2 : Unexpected backslashes remain in monitor 'username' attribute after upgrade

Component: Local Traffic Manager

Symptoms:
The monitor 'username' attribute contains unexpected backslashes.

Conditions:
Upgrading from an earlier version with a configuration that contains a monitor 'username' attribute with at least one escaped backslash ('\\').

Impact:
Monitor probes contain excess backslashes which can lead to monitor failures.

Workaround:
Un-escape backslashes after upgrade by transforming '\\' sequences to '\'.

Fix:
Removed excess backslashes from monitor 'username' attribute during upgrade process.


575292-4 : DNS Relay proxy service does not respond to SCM commands in timely manner

Component: Access Policy Manager

Symptoms:
DNS relay proxy service may appear unresponsive when stopped/started through Service control manager and user may see a system dialog box saying "Service did not respond in a timely manner"

Conditions:
DNS relay services component of edge client is installed on user's machine

Impact:
Usability, User may think that service has failed.

Workaround:
Wait for service to respond proper status

Fix:
Service now reports correct status to service control manager immediately.


575170-3 : Analytics reports may not identify virtual servers correctly

Component: Application Visibility and Reporting

Symptoms:
In certain configurations, Analytics statistics on virtual server activity may not be reported correctly.

Conditions:
This occurs for virtual servers that are configured in one of these ways:

1. Two virtual servers have the same IP-Port-RouteDomain setting, but they use different protocols (such as TCP for one and UDP for the other) or different sources.

2. A virtual server is defined with a masked IP address rather than an explicit address (for example, 10.10.10.0/24).

Impact:
As a result, Analytics reports show an Aggregated Virtual Server or an incorrect one instead of displaying the correct virtual servers.

Workaround:
None.

Fix:
Correct identification of the virtual server and the activity reported in the charts is displaying to the right virtual server.


575027-2 : Tagged VLAN configurations with a cmp-hash setting for the VLAN, might result in performance issues.

Component: TMOS

Symptoms:
Tagged VLAN configurations with a cmp-hash setting for the VLAN, might result in performance issues.

Conditions:
This occurs when the following conditions are met:
1. Use of tagged VLANs in the configuration.
2. Change cmp-hash of the tagged VLAN.

Impact:
Throughput is lower than expected. Packets are not being hashed using the hash set in config. (This can be verified by looking at 'tmm/flow_redir_stat'.)

Workaround:
Use untagged VLANs and hypervisor side tagging.

Fix:
You can now use tagged VLAN configurations along with a cmp-hash setting for the VLAN, without compromising performance.


575011-4 : Memory leak. Nitrox3 Hang Detected.

Solution Article: K21137299

Component: Local Traffic Manager

Symptoms:
System exhausts available memory due to compression memory leak. Prior to running out of memory, repeatedly logs "Nitrox3 Hang Detected".

Conditions:
Compression device unavailable during creation of a new context.

Impact:
System can run out of memory.

Workaround:
Disable hardware compression using tmsh:

% tmsh modify sys db compression.strategy softwareonly

Fix:
Repaired memory leak.


574781-2 : APM Network Access IPV4/IPV6 virtual may leak memory

Component: Access Policy Manager

Symptoms:
Observation of performance graphs shows increasing TMM memory usage over time. Specifically, xhead and xdata caches grow over time. Additionally, the ppp_npmode_errors in the ppp stat table will increment with each leak.

Conditions:
APM virtual with Network Access configured with IPV4 and IPv6.

Impact:
Memory leakage over time leads to performance degradation and possible traffic outage.

Workaround:
No workaround short of not enabling IPv6.

Fix:
APM Network Access now correctly manages its memory resources.


574451-2 : ASM chassis sync occasionally fails to load on secondary slot

Solution Article: K90243258

Component: Application Security Manager

Symptoms:
ASM chassis sync occasionally fails to load on secondary slot when a new policy is created after a series of other configuration changes in quick succession.

Conditions:
A new policy is created after a series of other configuration changes in quick succession

Impact:
ASM chassis sync fails to load on secondary slot.

Workaround:
Make another system-wide configuration change, such as creating a user-defined signature, or wait until the hourly sync occurs.

Fix:
ASM chassis blades are now synchronized correctly after every policy creation.


574153-2 : If an SSL client disconnects while data is being sent to SSL client, the connection may stall until TCP timeout.

Component: Local Traffic Manager

Symptoms:
If an SSL connection gracefully begins to disconnect at the same time as data is being encrypted by SSL acceleration hardware, the connection will remain open until the TCP profile timeout occurs instead of being closed immediately. This can cause unwanted higher memory usage, possibly causing crashes elsewhere.

Conditions:
* A virtual server with ClientSSL or ServerSSL profile.
* BIG-IP SSL acceleration hardware.
* While an SSL record is being encrypted by SSL accelerator hardware, the SSL connection begins to close by client TCP FIN or by any iRule command that closes the connection.

Impact:
There is a potential for higher memory usage, which in turn may cause TMM crash due to memory exhaustion resulting in service disruption.

Workaround:
If the affected SSL traffic does not include any long idle periods, memory consumption can be mitigated by reducing the idle timeout of the TCP or SCTP profile.

Fix:
SSL connections now disconnect normally if a disconnect attempt occurs while data is being encrypted by SSL acceleration hardware.


574116-2 : MCP may crash when syncing configuration between device groups

Component: TMOS

Symptoms:
mcpd on the sync target crashes when syncing configuration.

Conditions:
This can occur when a local non-synced object references an object that is synced (such as a local-only virtual server referencing a synced iRule), and a non-synced object on the target machine happens to be referencing the same synced object. In this condition, mcpd could crash if objects in a sync group are deleted and synced.

Impact:
Outage due to mcp crash which causes tmm to restart.

Workaround:
When you have devices with local-only resources that are referencing objects contained in a sync/failover group, avoid deleting any objects (such as iRules) that might be referenced by other local-only resources on other devices. Instead of a "this object is in use error", mcpd on the target machine will crash.

Fix:
Verify existence of rule objects when validating configuration.


574055-3 : TMM crash after changing raccoon log level

Component: TMOS

Symptoms:
TMM crashes after changing the raccoon log level to debug2

Conditions:
Debug level is set to debug2 while tmm is passing traffic

Impact:
Traffic disrupted while tmm restarts.

Workaround:
set debug level to INFO

Fix:
A tmm crash related to changing the debug level while passing traffic has been fixed.


574052-2 : GTM autoconf can cause high CPU usage for gtmd

Component: Global Traffic Manager

Symptoms:
The autoconf feature of GTM can cause high CPU utilization (~90%) under certain situations.

In large configurations of LTM vses that contain "." (dot) in the name.

Conditions:
Large configuration of LTM VS that contain "." in the name have the name converted ("." is replaced by "_") and the LTM VS name is saved to the config.

This causes the matching algorithm in autoconf to spend many CPU cycles walking the list of VS to find a match.

This problem is caused by large numbers of VSes on a GTM Server. (10k VSes on 10k Server is less of an issue
than 10k VSes on 1 GTM Server)

Impact:
CPU usage is high, which may impact monitoring and LB decisions.

Workaround:
There are some mitigations. The preferable (for performance
and stability) are listed first.

1. Rename the virtual servers on the LTM to remove the "."
   This would require deleting the GTM configuration and
   rediscovering it and recreating pools.

2. Turn off autoconf.
   Run autoconf once to populate the config, then turn it
   off.

3. Reduce the frequency of autoconf. It will still cause
   a high CPU usage scenario, but it will be less frequent.

Versions 12.0.0 and higher do not convert the "." to "_". So that problem is eliminated for new configurations.
If a customer upgrades to 12.0.0 and the config still contains VS names that were previously converted, they still may run into high CPU usage.
Upgrading to 12.0.0 alone does not fix this issue, a reconfig would be necessary.

Fix:
Change algorithm used to match LTM VS names to GTM VS to reduce linear walk of all VSes on a server.


574045-2 : BGP may not accept attributes using extended length

Component: TMOS

Symptoms:
If a BGP peer sends a path attribute using the "extended length" flag and field, the attribute may be rejected and the BGP connection terminated.

Conditions:
Neighbor sends path attributes using extended length.

Impact:
The BGP adacency will repeatedly bounce and the RIB will never converge.

Fix:
Received BGP attributes using extended length are no longer rejected.


574020-4 : Safenet HSM installation script fails to install successfully if partition password contains special metacharacters (!#{}')

Component: Local Traffic Manager

Symptoms:
Safenet HSM installation script fails to install successfully if partition password contains special metacharacters (!#{}').

Conditions:
This issue occurs when the following conditions are met:

-- Safenet HSM installation.
-- Password contains special metacharacters (!#{}').

Impact:
Script fails to work properly, and fails to properly install/configure the HSMs, requiring manual intervention. Performing the operation manually is very complex, because the user must account for both tmsh and shell quoting, which the some user environments might not have.

Workaround:
Change password, or manually run tmsh command to define the /sys crypto fips external-hsm object (using proper shell quoting).

Fix:
Safenet HSM installation script install now completes successfully if partition password contains special metacharacters (!#{}').

Note: When using passwords with non-alphanumeric characters, make sure that they are escaped correctly, so that bash does not attempt to reinterpret or expand the password.


573778-7 : QEMU vulnerability CVE-2016-1714

Solution Article: K75248350


573764-3 : In some cases, only primary blade retains it's statistics after upgrade on multi bladed system

Component: Application Visibility and Reporting

Symptoms:
Statistics from the primary blade remain after upgrade, but not from the other blades.

Conditions:
Upgrade to new version in multi bladed system.

Impact:
Not all statistics are present after upgrade.

Workaround:
No workaround


573643-2 : flash.utils.Proxy functionality is not negotiated

Component: Access Policy Manager

Symptoms:
Access to some field names of classes inherited from flash.utils.Proxy is broken.

Conditions:
Presence of flash.utils.Proxy descendants.

Impact:
Customer application malfunction.

Workaround:
None.


573581-4 : DNS Search suffix are not restored properly in some cases after VPN establishment

Component: Access Policy Manager

Symptoms:
Modified DNS suffix after VPN establishment and closure may result in failure to resolve some DNS names

Conditions:
DNS Relay proxy service is stopped in the middle of VPN session.
User's machine is rebooted.

Impact:
DNS suffixes are not restored properly which may lead to incorrect resolution of certain DNS names.

Workaround:
Any of the following workarounds
1) Do not stop DNS relay proxy service in the middle of a VPN session
2)Restore DNS search suffixes manually.


573429-1 : APM Network Access IPv4/IPv6 virtual may leak memory

Component: Access Policy Manager

Symptoms:
Observation of performance graphs shows increasing TMM memory usage over time. Specifically, connflow and tunnel_nexthop caches grow over time.

Conditions:
APM virtual with Network Access configured with no SNAT and both IPV4 and IPV6 enabled.

Impact:
Memory leakage over time leads to performance degradation and possible traffic outage.

Workaround:
No workaround short of not enabling IPv6 support.

Fix:
Network Access now correctly manages its memory resources.


573406-3 : ASU cannot be completed if license was last activated more than 18 months before

Component: Application Security Manager

Symptoms:
Attack Signature Update (ASU) if license was last activated more than 18 months before.

Conditions:
The license was last activated more than 18 months before.

Impact:
Attack SIgnature Update (ASU) cannot be performed.

Workaround:
The license must be re-activated.

Fix:
Attack Signature Update (ASU) can now be completed based on a license retrieved from server.


573402-2 : "C_GetAttributeValue error" with netHSM

Component: Local Traffic Manager

Symptoms:
When netHSM is used with BigIP, sometimes you will see "C_GetAttributeValue error".

Conditions:
When netHSM is used, this error message may appear.

Impact:
This message is benign and can be ignored.

Workaround:
This error message is not harmful. User can ignore them in the log.

Fix:
When netHSM is used, the benign 'C_GetAttributeValue error' messages are no longer posted.


573343-3 : NTP vulnerability CVE-2015-8158

Solution Article: K01324833


573124-2 : TMM vulnerability CVE-2016-5022

Solution Article: K06045217


573075-2 : ADAPT recursive loop when handling successive iRule events

Component: Service Provider

Symptoms:
After the first iRule resumes from being parked, ADAPT attempts to process the second iRule event repeatedly.
The connection is aborted with RST cause "ADAPT unexpected state transition".
The adapt profile statistic "records adapted" reaches a very high number as it counts every attempt.

Conditions:
A requestadapt or responseadapt profile is configured.
An iRule is triggered on the ADAPT_REQUEST_RESULT or ADAPT_RESPONSE_RESULT event, that parks.
The modified headers (from an ICAP server) arrive at the ADAPT filter while the first event is parked.
Any iRule on the ADAPT_REQUEST_HEADERS or ADAPT_RESPONSE_HEADERS event does not park.

Impact:
The connection is aborted with RST cause "ADAPT unexpected state transition".
The statistic "records adapted" reaches a very high number.
Eventually the TMM crashes and the Big-IP fails over.

Workaround:
If possible, arrange the iRules to avoid the conditions above.
In particular, if there is no better way, it is possible to avoid this if there is an iRule on the ADAPT_REQUEST_HEADERS or ADAPT_RESPONSE_HEADERS event that parks.

Fix:
ADAPT correctly processes successive iRule events exactly once for each adaptation, and the "records adapted" statistic reports the correct number.


572922-2 : Upgrade causes an ASM subsystem error of PL_PARAM_ATTRIBUTES.

Component: Application Security Manager

Symptoms:
The following error is produced in ASM log during upgrade:
-----------
ASM subsystem error (ts_configsync.pl,F5::DbUtils::insert_data_to_table): Row <some_row_id> of table <some_db_table_name> is missing <some_field_name> (DDD) -- skipping F5::<some_package_name>
-----------

Conditions:
ASM provisioned

Impact:
Different portions of the security policy may be incorrectly upgraded.

Workaround:
N/A

Fix:
We have fixed the root cause so that the following error does not reproduce upon upgrading:
ASM subsystem error (ts_configsync.pl,F5::DbUtils::insert_data_to_table): Row <some_row_id> of table <some_db_table_name> is missing <some_field_name> (DDD) -- skipping F5::<some_package_name>


572887-2 : DNS doesn't work properly on Ubuntu 15.10 when using f5fpc CLI client

Component: Access Policy Manager

Symptoms:
DNS doesn't work properly on Ubuntu 15.10 when using f5fpc CLI client. This happens because f5fpc fails to patch /etc/resolv.conf on Ubuntu 15.10 release.

Conditions:
/etc/resolv.conf, Ubuntu 15.10, f5fpc CLI client and network access establishment.

Impact:
DNS doesn't work properly on Ubuntu 15.10

Fix:
Now DNS works fine on Ubuntu 15.10 because /etc/resolv.conf can be patched correctly now by f5fpc command line client.


572885-2 : Policy automatic learning mode changes to manual after failover

Component: Application Security Manager

Symptoms:
Policy automatic learning mode changes to manual when a failover occurs.

Conditions:
ASM provisioned.
Device group w/ ASM policy sync configured.
ASM Policy is in automatic learning mode.
A failover occurs.

Impact:
The policy changes from automatic learning mode to manual.

Workaround:
None.

Fix:
Policy automatic learning mode no longer changes to manual when a failover occurs. Automatic learning mode will now be disabled only in active/active configurations.


572563-3 : PWS session does not launch on Internet Explorer

Component: Access Policy Manager

Symptoms:
Internet Explorer (IE) gets stuck entering Protected Work Space (PWS).

Conditions:
One of the DLLs provided by APM, vdeskctrl.dll, provides COM services. Internet Explorer (IE), consumes the COM services. The DLL is loaded by IE during upgrade of PWS components. For some reason (especially on slow systems), IE does not unload the the old DLL promptly after upgrading PWS. When COM services are invoked to initialize PWS after upgrade, old DLL provides the service. Due to the recent renewal of our signing certificate, old DLL can't certify the integrity of the new PWS components. We have researched the issue, but we have not found a way to instruct IE to unload the old DLL after upgrade.

Impact:
PWS session does not launch.

Workaround:
After upgrade, if Internet Explorer(IE) does not enter into PWS within 60 seconds, close IE and start a new session. This is an one time event.

Fix:
Internet Explorer can now launch a Protected Workspace session.


572543-2 : User is prompted to install components repeatedly after client components are updated.

Component: Access Policy Manager

Symptoms:
After auto-update of client components from internet explorer, user will be prompted to install components again if he goes to VPN site again.

Conditions:
Administrator upgrades big-ip to 12.1.
User has client components from a release older than 12.1

Impact:
User is prompted to install components again and again

Workaround:
Restart browser after components are updated the first time.


572495-3 : TMM may crash if it receives a malformed packet CVE-2016-5023

Solution Article: K19784568


572281-2 : Variable value in the nesting script of foreach command get reset when there is parking command in the script

Component: Local Traffic Manager

Symptoms:
When there is something like the following script:

foreach a [list 1 2 3 4] {
   set a 10
   after 100
}

There is parking command, after, in the script and it runs after "set a 10", when after command returns, the value of a goes back to the initial value set in the foreach, value of 10 is lost.

Conditions:
There is parking command in the nesting script of foreach. For more information on commands that park, see K12962: Some iRule commands temporarily suspend iRule processing at https://support.f5.com/csp/#/article/K12962

Impact:
Variable values get reset.

Workaround:
Set(or set again) the variable value after the parking command.

Fix:
Will fix in later release.


572224-4 : Buffer error due to RADIUS::avp command when vendor IDs do not match

Component: Service Provider

Symptoms:
Errors similar to the following in the ltm log:

err tmm3[21915]: 01220001:3: TCL error: /Common/RadiusTest CLIENT_DATA - Buffer error (line 1) (line 1) invoked from within 'RADIUS::avp 26 ip4 index 0 vendor-id 12345 vendor-type 6'.

Conditions:
The issue happens when there is a RADIUS::avp command for a vendor specific AVP and there's a RADIUS request that contains a different vendor-id than what was specified in the iRule command.

Impact:
You are unable to use vendor-specific RADIUS AVP commands

Workaround:
None.

Fix:
Vendor-specific RADIUS AVP commands no longer generate errors.


572133-2 : tmsh save /sys ucs command sends status messages to stderr

Component: TMOS

Symptoms:
When you run the tmsh save /sys ucs command, some normal status messages are being sent to stderr instead of stdout. This will be seen if a you are watching stderr for error messages.

Conditions:
There are no conditions, every time the command is run, it will send some status type messages to stderr.

Impact:
If a script runs the command it may report that the save failed because messages were send to stderr.

Workaround:
You can ignore the message "Saving active configuration..." being sent to stderr. It is not an error.

Fix:
The command will send the status messages to stdout.


572086 : Unable to boot v11.6.0 on 7250 or 10250 platforms

Solution Article: K49725838

Component: TMOS

Symptoms:
Unable to boot or system constantly rebooting.

Conditions:
Booting into v11.6.0 on 7250 or 10250 platform with RAID disk layout.

Impact:
Unable to boot.

Workaround:
None.

Fix:
This version of the software boots boots correctly on 7250 or 10250 platforms with RAID disk layout.


572025-2 : HTTP Class profile using a path selector upgrade to a policy that does not match the entire path

Component: Local Traffic Manager

Symptoms:
If you upgrade to version 11.4.0 through 12.0.0, and your configuration contains a HTTP Class profile containing a paths selector, the generated policy does not match.

Conditions:
A HTTP Class profile containing a paths selector.

Impact:
The generated policy does not match the same paths as original HTTP Class profile.

Workaround:
Manually edit resulting policy

Fix:
The path selector specifier is no longer added to the generated policy allowing the entire http-uri to matched.


572015-3 : HTTP Class profile is upgraded to a case-insensitive policy

Component: Local Traffic Manager

Symptoms:
If you upgrade to version 11.4.0 through 12.0.0, and your configuration contains a HTTP Class profile, the generated policy will be case-insensitive.

Conditions:
HTTP Class profile

Impact:
Generated policy does not match on the same conditions as original HTTP Class profile.

Workaround:
Manually edit generated policy

Fix:
The case-sensitive attribute is added to generated policies during upgrade.


571573-2 : Persistence may override node/pmbr connection limit

Solution Article: K20320811

Component: Local Traffic Manager

Symptoms:
In certain circumstances the BIG-IP system may load balance connections to a node or poolmember over the configured connection limit.

Conditions:
- Node or pool member configured with connection limit.
- L4 or L7 virtual server.
- Persistence configured on the Virtual Server.
- Very high load on unit.

Impact:
BIG-IP system may load balance connections to a node or pool member over the configured connection limit.

Workaround:
Remove persistence or use another method of limiting the connections (rate limiting or connection limit on the Virtual Server).

Fix:
The BIG-IP system now correctly enforces the pool member/node connection limit.


571344-3 : SSL Certificate with special characters might cause exception when GUI retrieves items list page.

Component: TMOS

Symptoms:
After upgrading, unable to view certain certs from gui. Catalina.out file could contain the signature MalformedByteSequenceException: Invalid byte 2 of 3-byte UTF-8 sequence.

iControl SOAP methods
====================
Management::KeyCertificate::get_certificate_list and get_certificate_list_v2 will return an exception if returning a certificate with special characters.

Conditions:
SSL Certificate with special characters might cause exception when GUI retrieves items list page. This has been observed on upgrades to BIG-IP version 11.5.4 through 12.0.0.

Impact:
The GUI does not display the page containing certificate information. iControl SOAP cannot return a list of certificates if they contain information with special characters.

Workaround:
None.

Fix:
The GUI now correctly displays certificates with special characters, and iControl SOAP methods Management::KeyCertificate::get_certificate_list and get_certificate_list_v2 no longer return exceptions.


571210-4 : Upgrade, load config, or sync might fail on large configs with large objects.

Component: TMOS

Symptoms:
Attempting to load a large config with large objects may result in the following error message:

err mcpd[7366]: 01070710:3: Database error (52), Can't write blob data, attribute:implementation status:52 - EdbBlobData.cpp, line 57

Attempting to synchronize a large change may result in the following error messages and a crash of the MCPD process:

err mcpd[8210]: 01071693:3: Incremental sync: Caught an exception while adding a transaction to the incremental config sync cache: unexpected exception.

err mcpd[8210]: 01070734:3: Configuration error: MCPProcessor::processRequestNow: Can't write blob data, attribute:msgs status:52

err mcpd[8210]: 01070596:3: An unexpected failure has occurred, request_group destroyed while processing, exiting...

Conditions:
The config must be approximately 19.75 MB (slightly less) prior to processing a large object in the config that exceeds 256 KB.

Or, once config exceeds 19.75 MB and 2 MB of additional memory has been allocated, processing config objects that exceed 256 KB (the larger, the more likely to occur) lead to the error.

Impact:
Upgrade, load config, or sync might fail, and a system crash and restart might occur.

Workaround:
Stagger the load, or reduce the size of particularly large objects within a config.

Fix:
Memory handling is improved so that large configs with large objects now successfully complete upon upgrade, load config, or sync.


571183-2 : Bundle-certificates Not Accessible via iControl REST.

Component: Local Traffic Manager

Symptoms:
Bundle-certificates Not Accessible via iControl REST.

Conditions:
This occurs when using iControl REST to look at bundle certificates via /mgmt/tm/sys/file/ssl-cert/~Common~ca-bundle.crt/bundle-certificates

Impact:
Unable to get data from the command.

Workaround:
If you do not need to do it via iControl REST, you can view bundle certificates using the tmsh command tmsh list sys file ssl-cert ca-bundle.crt bundle-certificates

Fix:
The iControl rest command for viewing bundle-certificates now displays all of the certificates.


571090 : When BIG-IP is used as SAML IdP, tmm may restart under certain conditions

Component: Access Policy Manager

Symptoms:
tmm restarts.

Conditions:
It is not known exactly what the conditions are, but this occurs when BIG-IP is configured as SAML IdP.

Impact:
Tmm may restart.

Workaround:
None


571019-3 : Topology records can be ordered incorrectly.

Component: TMOS

Symptoms:
Topology records can contain missing order numbers, duplicate order numbers, and differences in the ordering of topology records on BIG-IP's in a sync group.

Conditions:
When adding or deleting topology records or modifying the order of existing topology records, the resulting ordering of the topology records can be inconsistent. This can lead to ordering issues including differences in the ordering of topology records on BIG-IP's in a sync group.

Impact:
It is difficult to manage the order of topology records. Topology records are evaluated in different orders on different BIG-IP's in a sync group.

Workaround:
None.

Fix:
Topology records are now ordered consistently.


571003-1 : TMM Restarts After Failover

Component: Access Policy Manager

Symptoms:
TMM generates core file and restarts.

Conditions:
1. In a HA pair running pre 11.5.3-HF2 or 11.6.0-HF6, the standby is upgraded to 11.6.0-HF6 EHF 186, 241, 243, or 247.
2. Force failover.
3. A new session is established or an existing session terminated.

Impact:
Serivce is disrupted. All existing sessions are terminated.

Workaround:
None.

Fix:
TMM no longer generates core file and restarts upon upgrade.


570973-2 : L7 hardware syn cookie feature is broken in BIG-IP v12.0.0 hf1 and hf2

Component: TMOS

Symptoms:
In BIG-IP v12.0.0 hf1 and hf2 hardware syn cookie feature for L7 (e.g. Standard Virtual Server type or FastL4 with http profile) virtual server is broken due to HSB bitstream update with a new hardware syn cookie algorithm. It does not impact 12.0.0 base release.

Conditions:
Hardware syn cookie is enabled (which is the default setting) on L7 virtual server.

Impact:
When syncookie protection is triggered, ingress legitimate traffic may be dropped by BIG-IP.

Workaround:
Disable hardware syn cookie on L7 virtual servers.

Note: After this workaround you may encounter Bug ID 555020 SW syncookies and windowscaling will cause 3WHS to fail on L7 VIP in which case you would need to apply the workaround from that as well.

Fix:
This bug is fixed in 12.0.0-hf3 and 12.1.0.


570926-1 : Provide a way to configure where in payload the CSPM JS is injected.

Component: Application Visibility and Reporting

Symptoms:
This is an enhancement that allows you to choose where in the document the CSPM script will be injected.

Conditions:
You are using some application that can't read the document if something appears after closing the html tag.

Impact:
Today we append the CSPM payload (for client latency measurements) at the end of the HTML document (after the html tag).
This works in browsers but it's not compliant to the HTML standard and may break some applications that rely on this standard (not browsers).

Workaround:
Un-checking "Page Load Time" in analytics profile.

Fix:
Verify that script was injected to the chosen location in the returned document.


570881-4 : IPsec configuration mismatch in IKEv2 causes TMM crash in isakmp_parse_proposal ()

Component: TMOS

Symptoms:
crash (NULL pointer access)

Conditions:
IPsec configuration mismatch in IKEv2 (for initiator and responder)

Impact:
Traffic disrupted while tmm restarts.

Workaround:
use correct configuration

Fix:
Proper reaction (connection reject) was added for improper configuration.


570818-2 : Address lease-pool in IKEv2 might interfere with IKEv2 negotiations.

Component: TMOS

Symptoms:
LTM IPsec IKEv2 does not support dynamic remote-address CONFIG option, but still might potentially process that information sent by third-party devices. The configuration changes from this option might affect traffic-selector selection in IKEv2 negotiations, leading to wrong matching results and failure in establishing IPsec SA.

Conditions:
Certain third-party vendor devices are the remote IKEv2 peer, for example, a CISCO APIC device.

Impact:
Failure in establishing IPsec SA.

Workaround:
None.

Fix:
Address lease-pool in IKEv2 no longer interferes with IKEv2 negotiations.


570716-3 : BIG-IP IPsec IKE peer listener vulnerability CVE-2016-5736

Solution Article: K10133477


570667-16 : OpenSSL vulnerabilities

Solution Article: K64009378


570663-3 : Using iControl get_certificate_bundle_v2 causes a memory leak

Component: TMOS

Symptoms:
Using iControl call get_certificate_bundle_v2() causes a memory leak. iControlPortal memory use grows unbounded every time the method is called.

Conditions:
This occurs anytime the method is invoked; BIG-IP devices managed by Enterprise Manager can be especially impacted.

Impact:
Eventually iControlPortal will run out of memory and crash.

Fix:
The memory leak issue has been fixed.


570640-2 : APM Cannot create symbolic link to sandbox. Error: No such file or directory

Component: Access Policy Manager

Symptoms:
The user may encounter the following configuration error when adding a new APM sandbox-contained object in a non-default partition (other than /Common) if the user has ever attempted (but failed) to delete this partition (for example, couldn't delete it because it was not empty).

01070734:3: Configuration error: Cannot create symbolic link to sandbox. Error: No such file or directory. If you have access to bash shell, try to run command: ln -s /config/filestore/files_d/p1_d/sandbox_file_d /var/sam/www/webtop/sandbox/files_d/p1_d/sandbox_file_d. Then try to upload file again.
Unexpected Error: Validating configuration process failed.

Conditions:
The user has ever attempted (but failed) to delete the partition.

Impact:
No more APM sandbox object such as Hosted-Content can be added to the partition.

Upgrade may fail to install configuration with the impacted sandbox object.

Workaround:
Manually use the shell command 'mkdir -p' to re-create the missing folder where the symbolic link is suppsed to be created as shown in the error message.

Directories are: {to do mkdir -p)
/config/filestore/files_d/OUTSIDE_PROD_d/sandbox_file_d
/var/sam/www/webtop/sandbox/files_d/OUTSIDE_PROD_d/sandbox_file_d
After creating the directors sync to active unit.


570617-4 : HTTP parses fragmented response versions incorrectly

Component: Local Traffic Manager

Symptoms:
When a fragmented response is parsed by HTTP, the version field may be incorrectly bounded. HTTP correctly determines the version of the response. However, other filters that re-scan the version field might see a truncated value. The filters then miss-parse the HTTP version.

Conditions:
A fragmented response where the HTTP version field appears in multiple packets. Another filter, for example VDI, re-scans the HTTP version field.

Impact:
The detected version of HTTP may be incorrect. Typically, the response is detected as a HTTP/0.9 response rather than the 1.0 or 1.1 response it actually uses.

Workaround:
None.

Fix:
HTTP correctly bounds the response version for other filters to parse.


570563-2 : CRL is not being imported/exported properly

Solution Article: K35470551

Component: Access Policy Manager

Symptoms:
CRL assigned as part of Machine Cert Auth is not being imported/exported properly.

Conditions:
This occurs when importing SSL Certificates and Keys using the CRL type. Or when adding the Machine Cert Check agent to import an Access Profile in when creating a New Certificate Authority Profile.

Impact:
Prevents CRL from being exported. Might also impact the import/export of Certificate Authority Profiles.

Workaround:
1. Copy and install the CRL to the other BIG-IP system separately.
2. Modify the exported configuration to use CRL from step 1

Fix:
Import and export of CRL is fully supported.


570535 : Multiple Kernel Vulnerabilities

Solution Article: K15685 K15912 K31300371 K16011 K21632201 K31026324 K17239 K17543 K17121 K41739114 K17246 K17458 K17244 K17245 K90230486 K17309 K17307 K31026324 K94105604


570419-2 : Use of session DB on multi-process appliances and blades may core.

Component: TMOS

Symptoms:
On selected devices and blades, tmm runs multiple processes. When running multiple processes, the session DB may occasionally attempt an operation that will cause a tmm segfault.

Conditions:
In order to experience this failure, tmm must be running in multiple processes on the appliance or on the blade, and session DB usage is required with mirroring.

Impact:
Outage and restart of tmm. This applies when bringing up blades as well as bringing peers online.

Workaround:
None.

Fix:
Use of session DB on multi-process appliances and blades no longer cores when bringing up blades as well as bringing peers online.


570363-2 : Potential segfault when MRF messages cross from one TMM to another.

Component: Service Provider

Symptoms:
Potential segfault when Message Routing Framework (MRF) messages cross from one TMM to another.

Conditions:
This issue occurs when MRF messages travel from one TMM to another, and an asynchronous operation also occurs (like persistence).

Impact:
It is possible for the message object to be removed before the asynchronous operation completes. If this occurs, a segfault may occur and the system might restart.

Workaround:
None.

Fix:
This release corrects the issue of potential segfault occurring when MRF messages cross from one TMM to another.


570064-3 : IE gives a security warning asking: "Do you want to run ... InstallerControll.cab"

Component: Access Policy Manager

Symptoms:
When logging into a VPN connection using Internet Explorer, Internet Explorer may prompt "Do you want to run ... InstallerControll.cab"

Conditions:
BIG-IP APM configured and is accessed by Internet Explorer. This can happen after an upgrade of BIG-IP.

Impact:
The prompt should not occur.

Fix:
Internet Explorer will no longer prompt to run InstallerControll.cab


570057-3 : Can't install more than 16 SafeNet HSMs in its HA group

Component: Local Traffic Manager

Symptoms:
With installation script on the BIG-IP, you can't install more than 16 SafeNet HSMs in its high availability group with versions 5.2 and 5.4.

Conditions:
Attempt to install more than 16 SafeNet HSMs.

Impact:
Installer script failure.

Workaround:
The limit is set by SafeNet. Currently, with F5-supported 5.2 and 5.4 client software, SafeNet doesn't allow more than 16 HSMs in one high availability configuration.

Fix:
Updated SafeNet installation scripts by replacing "vtl" to "lunacm" for high availability group creation and member adding operations for version 6.2.


570053-2 : HA peer's certkeychain of clientssl profile is unexpectedly either removed or re-named after config sync.

Solution Article: K78448635

Component: TMOS

Symptoms:
HA peer's certkeychain of clientssl profile is unexpectedly either removed or re-named after config sync.

Conditions:
The issue is seen when all the below conditions are met.
1. When more than one certkeychains are configured in the clientSSL profile.
2. When the content of a certkeychain of the clientSSL profile is modified. For example, "modify ltm profile client-ssl a4 cert-key-chain modify { default { cert rsa.crt key rsa.key } }".
3. Performs config sync in HA setup.

Impact:
Missing certkeychain of a clientSSL profile can result in its inability to handle some kind of SSL traffic. For example, if the clientSSL originally has EC key/cert but loses it, then it is no longer able to handle SSL connection using EC cipher suites.

Workaround:
Basically reconfigure certkeychain but avoid modifying the content.
1. On any BIG-IP system, leave only the RSA certkeychain in the clientSSL profile, just like the default configuration.
2. Config sync, so that both systems have only the RSA certkeychain.
3. In any BIG-IP system, add certkeychains for other types (EC or DSA) you need. You can "add" or "delete" but do not "modify" any existing certkeychain.
4. Do config sync, so that both systems have the same certkeychains in the clientSSL profile.


569972-2 : Unable to create gtm topology records using iControl REST

Component: Global Traffic Manager

Symptoms:
The user is unable to create gtm topology records using iControl REST.

Conditions:
This occurs when a user issues an iControl REST POST command for a gtm topology record.

Impact:
The iControl REST POST command fails with the following error: 'Topologies must specify both regions: ldns: server:'.

Workaround:
Use TMSH, iControl SOAP, or the GUI to create gtm topology records.

Fix:
You can now create gtm topology records using iControl REST.

Please be sure to format the gtm topology oid string using the following rules:

1) Use only a single space between each item in the topology string.
2) Use a fully-pathed name for datacenter, isp, region, and pool objects.

For example:
"ldns: subnet 11.11.11.0/24 server: datacenter /Common/DC".


569958-2 : Upgrade for application security anomalies

Component: Application Visibility and Reporting

Symptoms:
If upgrading to newer version, old statistics for application security anomalies are not shown.

Conditions:
Upgrade from BIG-IP version older than 12.1.0 to newer version

Impact:
Losing old statistics for application security anomalies

Fix:
Upgrade to newer version and verify that old statistics are shown.


569642-4 : Deleting all routes on a unit with a mirroring fastL4 Virtual may cause TMM to core

Component: Local Traffic Manager

Symptoms:
In certain circumstances TMM may core if an HA pair configured with mirroring has all the routes to the server pool removed.

Conditions:
- HA pair.
 - FastL4 VIP with mirroring.
 - default route to pool via an intermediate router.
 - The active unit is handling traffic.
 - Active unit fails over and loses its mirroring connection.
 - Prior active unit comes back and HA connection is reestablished.
 - During the loss of HA and its recovery the now active unit loses its only route to the pool member.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not remove all routes to poolmembers. If this is needed please create other backup routes prior to the deletion.

Fix:
TMM no longer cores on deleting all routes on a unit with a mirroring fastL4 Virtual during HA connection loss and recovery.


569634 : Aced process is not able to listen to port 6000

Component: TMOS

Symptoms:
When Aced process cannot listen to the port, it aborts and causes core dump to be produced.

Conditions:
In certain scenarios, an exiting instance of aced process does not perform a proper cleanup of the socket(listening of port 6000) and does not exit completely and the new instance of aced wont be able to listen to it.

Impact:
Aced process keeps crashing repeatedly.

Fix:
Aced process is fixed in order to explicitly close the socket file descriptor during exit. The new instance will be able to listen to that port.


569583-1 : Secondary Blade Rejects All Traffic after being added to the chassis

Component: Application Security Manager

Symptoms:
After an upgrade ends in errors, the device may be left in a state that it erroneously believes to still be in the middle of the upgrade.

Conditions:
A second blade is installed into a chassis and there are errors as it comes up.
System configuration is never successfully loaded. This can occur during upgrades to versions prior to 12.0.0.

Impact:
Secondary blade blocks all ASM traffic.

Workaround:
1) Delete the /var/ts/var/install/ucs_install.pid file on all blades
2) Push a fresh sync from a good device.

Fix:
The system correctly detects that it is no longer in the middle of an upgrade.


569521-4 : Invalid WideIP name without dots crashes gtmd.

Component: Global Traffic Manager

Symptoms:
If a user creates a WideIP or WideIP Alias with a name that does not contain a dot, gtmd crashes.

The symptom is a crash and core dump from gtmd.

Conditions:
This occurs when the following conditions are met:
-- FQDN validation is suppressed by the following setting: gtm global-settings general domain-name-check == 'none'.
-- User attempts to create a WideIP with a name that does not contain a dot.

Impact:
gtmd crashes and WideIPs do not function.

Workaround:
When creating a WideIP or WideIP Alias while FQDN validation has been disabled (by setting gtm global-settings general domain-name-check == 'none'), make sure that the WideIP or WideIP Alias name contains at least one dot, and follows these rules:
-- The name must not end with a dot.
-- The name must not begin with a dot, unless '.' is the entire name.
-- The name contains no consecutive dots.

Fix:
FQDN now validates to confirm that a WideIP or WideIP Alias name has at least one dot in an appropriate position, and has no consecutive dots, so there is no crash and core dump from gtmd. This validation occurs even when other FQDN validation has been suppressed by setting
gtm globlal-settings general domain name check == 'none'.


569472-2 : TMM segfault in lb_why_pmbr_str after GTM/BIG-IP DNS disables a GTM pool and LB why log is enabled

Component: Global Traffic Manager

Symptoms:
tmm cores with sigsegv within lb_why_pmbr_str.

Conditions:
1. Disable a GTM/BIG-IP DNS pool or pool member;
2. pool-member-selection is enabled for load-balancing-decision-log-verbosity.

Impact:
tmm cores.

Workaround:
Disable pool-member-selection for load-balancing-decision-log-verbosity.

Fix:
tmm no longer cores when disabling pool-member-selection for load-balancing-decision-log-verbosity.


569467-11 : BIG-IP and BIG-IQ cloud image vulnerability CVE-2016-2084.

Solution Article: K11772107


569356-2 : BGP ECMP learned routes may use incorrect VLAN for nexthop

Solution Article: K91428939

Component: TMOS

Symptoms:
Border Gateway Protocol (BGP) with Equal Cost Multipath (ECMP) may result in learned routes that use an incorrect nexthop Virtual Local Area Network (VLAN).

As a result of this issue, you may encounter one or more of the following symptoms:

The system may randomly send the traffic using the incorrect nexthop.

Conditions:
-- BIG-IP configuration with two or more VLANs configured with IPv6 global addresses.
-- BGP with ECMP is peered with an active IPv6 BGP neighbor. -- BGP is configured with max-paths.

Impact:
The traffic randomly gets sent using the incorrect nexthop.

Workaround:
None.

Fix:
Routes learned from the peer now have the correct nexthop VLANs.


569355-3 : Java vulnerabilities CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494

Solution Article: K50118123


569349-2 : Packet's vlan priority is not preserved for CMP redirected flows when net cos feature is enabled

Component: Local Traffic Manager

Symptoms:
When net cos (class of Service) feature is enabled, vlan priority for those cmp redirected packets are not being preserved from ingress to egress.

Conditions:
1. net cos feature is enabled
2. packet is being cmp redirected from one tmm to another tmm for processing.

Impact:
Egress packets are not being processed according to the ingress vlan priority by BIG-IP and down stream router. Certain packets will be dropped by downstream router due to the wrong mark of vlan priority.

Workaround:
None.


569337-2 : TCP events are logged twice in a HA setup

Component: Advanced Firewall Manager

Symptoms:
TCP log events are logged twice (if enabled in security log profile) with connection mirroring enabled on the virtual server in a HA setup (Active/Standby).

Conditions:
When there's a HA setup (Active/Standby) or both client side and server side connection flow.

Impact:
T