NimbostratusAPM version by copyright banner
Hello,
We are customers of a service provider that use APM.
I noticed the the logout page has a footer banner of "This product is licensed from F5 Networks. © 1999-2018 F5 Networks. All rights reserved.", which alerted me that the provider is probably using an old, outdated and very likely - vulner version of APM.
The url is of https://<FQDN>/vdesk/hangup.php3
I contacted the CISO of the provider and he refused to disclose their APM version number in any way and simply stated they use APM's latest version with all the security patches, and that he addressed the F5 support about this and they stated to him that they don't change this banner with new versions on every year change.
If I test this with other public facing APM, I do see different copyright banners, like:
1.
"This product is licensed from F5 Networks. © 1999-2019 F5 Networks. All rights reserved." at https://pureauth.bgu.ac.il/vdesk/hangup.php3
2.
"This product is licensed from F5 Networks. © 1999-2020 F5 Networks. All rights reserved." at https://85.118.211.175/vdesk/hangup.php3
3.
"Protected using F5 APM. All rights reserved." at https://federate.f5.com/vdesk/hangup.php3, but ""This product is licensed from F5 Networks. © 1999-2019 F5 Networks. All rights reserved. "" at https://federate.f5.com/public/include/css/apm.css
Hence, I suspect the provider's CISO is aligned with F5's reality and does use an old version of APM. What do you say?
Well, it depends, you can use a release v14 with all the security patches and it's an up to day version, even when there are other major releases available (v15, v16).
Also, this page is completely customizable. So you can put whatever you want in that footer.
Then, you cannot conclude this with only this info.
