For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

strongarm_46960's avatar
strongarm_46960
Icon for Nimbostratus rankNimbostratus
Feb 27, 2009

304 Status responses bug discovered

Today I reported a new bug in BIG-IP ASM Version 9.4.6 401.0, for RAM Cache and 304 Status responses for requests without IMS headers. I thought this should have been fixed under CR62309, its return...
application delivery
dev
devops
iRules
strongarm_46960's avatar
strongarm_46960
Icon for Nimbostratus rankNimbostratus
Feb 27, 2009
This bug manifest itself by the LTM sending a HTTP 304 Status Response code to any browsers. Okay, Ordinarily there’s nothing wrong with the LTM sending HTTP 304 Status Response code to a browser, however, sending it without receiving a browser If-Modified-Since request header breaks the RFC 2616, and therein lies the bug.

 

 

In most cases during this 304 bug transaction, a If-Modified-Since was generated from the LTM to the backend, and was captured in the debugging within , consequently, a 304 Response was seen in Rule debug-304 .

 

 

Somehow the if-Modified-Since sent from the LTM to the backend, which generated a 304 response, also triggers a 304 sent to the user aswell, which then produces the bug.

 

 

This bug affects all browsers, thus all LTM cached objects which include all images, JavaScript & css. This system flaw affects user experience.