Multiple vulnerabilities in F5 BIG-IP

Published: 2018-05-17 | Updated: 2018-05-22

Risk	Medium
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2017-6143 CVE-2017-6156 CVE-2017-6148 CVE-2018-5507 CVE-2018-5506 CVE-2018-5511 CVE-2018-5508 CVE-2017-6158
CWE-ID	CWE-20 CWE-404 CWE-307 CWE-77 CWE-19
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	BIG-IP AFM Hardware solutions / Security hardware applicances BIG-IP LTM Hardware solutions / Security hardware applicances BIG-IP Analytics Hardware solutions / Security hardware applicances BIG-IP APM Hardware solutions / Security hardware applicances BIG-IP ASM Hardware solutions / Security hardware applicances BIG-IP GTM Hardware solutions / Security hardware applicances BIG-IP PEM Hardware solutions / Security hardware applicances BIG-IP AAM Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP DNS Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP Edge Gateway Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP Link Controller Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP WebAccelerator Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP WebSafe Server applications / Server solutions for antivurus protection Enterprise Manager Client/Desktop applications / Other client software
Vendor	F5 Networks

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU12772

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-6143

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated. A remote attacker can gain access to potentially sensitive information.

Mitigation

Update to versions 13.0.0, 12.1.2 HF1, 11.6.3 or 11.5.6.

Vulnerable software versions

BIG-IP AFM: 11.5.1 - 12.1.2

CPE2.3

External links

https://support.f5.com/csp/article/K11464209

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU12774

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Green]

CVE-ID: CVE-2017-6156

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists due to improper input validation when the system is configured with a wildcard IPSec tunnel endpoint. A remote attacker can disrupt or impersonate the tunnels that have completed phase 1 IPSec negotiations.

Mitigation

Update to versions 13.0.0, 12.1.2, 11.6.1 HF2 or 11.5.6.

Vulnerable software versions

BIG-IP LTM: 11.2.1 - 12.1.1

BIG-IP AAM: 11.2.1 - 12.1.1

BIG-IP AFM: 11.2.1 - 12.1.1

BIG-IP Analytics: 11.2.1 - 12.1.1

BIG-IP APM: 11.2.1 - 12.1.1

BIG-IP ASM: 11.2.1 - 12.1.1

BIG-IP DNS: 11.2.1 - 12.1.1

BIG-IP Edge Gateway: 11.2.1 - 12.1.1

BIG-IP GTM: 11.2.1 - 12.1.1

BIG-IP Link Controller: 11.2.1 - 12.1.1

BIG-IP PEM: 11.2.1 - 12.1.1

BIG-IP WebAccelerator: 11.2.1 - 12.1.1

BIG-IP WebSafe: 11.2.1 - 12.1.1

CPE2.3

External links

https://support.f5.com/csp/article/K05263202

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper resource shutdown

EUVDB-ID: #VU12805

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-6148

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to responses to SOCKS proxy requests made through the BIG-IP system. A remote attacker can cause the service to crash.

Mitigation

Update to versions 11.5.6, 11.6.3, 12.1.3.2, 13.0.1 or 13.1.0.

Vulnerable software versions

BIG-IP LTM: 11.5.1 - 13.0.0

BIG-IP AAM: 11.5.1 - 13.0.0

BIG-IP AFM: 11.5.1 - 13.0.0

BIG-IP APM: 11.5.1 - 13.0.0

BIG-IP ASM: 11.5.1 - 13.0.0

BIG-IP Link Controller: 11.5.1 - 13.0.0

BIG-IP PEM: 11.5.1 - 13.0.0

BIG-IP WebSafe: 11.5.1 - 13.0.0

CPE2.3

External links

https://support.f5.com/csp/article/K55225440

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper resource shutdown

EUVDB-ID: #VU12806

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-5507

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to incorrect decryption of ciphertext from established SSL sessions with small MTU. An adjacent attacker can cause the service to crash.

Mitigation

Update to versions 11.5.6, 11.6.3, 12.1.3.2, 13.0.1 or 13.1.0.

Vulnerable software versions

BIG-IP LTM: 11.5.1 - 13.0.0

BIG-IP AAM: 11.5.1 - 13.0.0

BIG-IP AFM: 11.5.1 - 13.0.0

BIG-IP APM: 11.5.1 - 13.0.0

BIG-IP ASM: 11.5.1 - 13.0.0

BIG-IP Link Controller: 11.5.1 - 13.0.0

BIG-IP PEM: 11.5.1 - 13.0.0

BIG-IP WebSafe: 11.5.1 - 13.0.0

CPE2.3

External links

https://support.f5.com/csp/article/K52521791

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Brute-force attack

EUVDB-ID: #VU12849

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-5506

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to bypass security restrctions on the target system.

The weakness exists in the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp due to handling of invalid IP addresses. A remote attacker can bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager (EM) and managed BIG-IP devices.

Mitigation

Update to versions 11.5.6, 11.6.2, 12.1.3.2, 13.0.0 HF1, 13.0.1 or 13.1.0.

Vulnerable software versions

BIG-IP LTM: 11.2.1 - 13.0.0

BIG-IP AAM: 11.2.1 - 13.0.0

BIG-IP AFM: 11.2.1 - 13.0.0

BIG-IP Analytics: 11.2.1 - 13.0.0

BIG-IP APM: 11.2.1 - 13.0.0

BIG-IP ASM: 11.2.1 - 13.0.0

BIG-IP DNS: 11.2.1 - 13.0.0

BIG-IP Edge Gateway: 11.2.1 - 13.0.0

BIG-IP GTM: 11.2.1 - 13.0.0

BIG-IP Link Controller: 11.2.1 - 13.0.0

BIG-IP PEM: 11.2.1 - 13.0.0

BIG-IP WebAccelerator: 11.2.1 - 13.0.0

BIG-IP WebSafe: 11.2.1 - 13.0.0

CPE2.3

External links

https://support.f5.com/csp/article/K65355492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Command injection

EUVDB-ID: #VU12846

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-5511

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.

The weakness exists in the Traffic Management User Interface due to command injection. A remote attacker can execute arbitrary commands with root privileges.

Mitigation

Update to version 13.1.0.4 or 13.0.1.

Vulnerable software versions

Enterprise Manager: 3.1.1

BIG-IP LTM: 13.0.0 - 13.1.0

BIG-IP AAM: 13.0.0 - 13.1.0

BIG-IP AFM: 13.0.0 - 13.1.0

BIG-IP Analytics: 13.0.0 - 13.1.0

BIG-IP APM: 13.0.0 - 13.1.0

BIG-IP ASM: 13.0.0 - 13.1.0

BIG-IP DNS: 13.0.0 - 13.1.0

BIG-IP Edge Gateway: 13.0.0 - 13.1.0

BIG-IP GTM: 13.0.0 - 13.1.0

BIG-IP Link Controller: 13.0.0 - 13.1.0

BIG-IP PEM: 13.0.0 - 13.1.0

BIG-IP WebAccelerator: 13.0.0 - 13.1.0

BIG-IP WebSafe: 13.0.0 - 13.1.0

CPE2.3

External links

https://support.f5.com/csp/article/K30500703

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Data handling

EUVDB-ID: #VU12844

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-5508

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in TMM due to processing compressed data through a Virtual Server with an associated PEM profile using the content insertion option. A remote attacker can cause the service to crash.

Mitigation

Update to versions 13.1.0, 12.1.3.2, 11.6.3 or 11.5.6.

Vulnerable software versions

BIG-IP PEM: 11.2.1 - 13.0.0

CPE2.3

External links

https://support.f5.com/csp/article/K10329515

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Data handling

EUVDB-ID: #VU12843

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-6158

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in TMM due to handling of invalid IP addresses. A remote attacker can cause the service to crash.

Mitigation

Update to versions 11.5.6, 11.6.2, 12.1.3 or 13.0.0.

Vulnerable software versions

BIG-IP LTM: 11.2.1 - 12.1.2

BIG-IP AAM: 11.2.1 - 12.1.2

BIG-IP AFM: 11.2.1 - 12.1.2

BIG-IP Analytics: 11.2.1 - 12.1.2

BIG-IP APM: 11.2.1 - 12.1.2

BIG-IP ASM: 11.2.1 - 12.1.2

BIG-IP DNS: 11.2.1 - 12.1.2

BIG-IP Edge Gateway: 11.2.1 - 12.1.2

BIG-IP GTM: 11.2.1 - 12.1.2

BIG-IP Link Controller: 11.2.1 - 12.1.2

BIG-IP PEM: 11.2.1 - 12.1.2

BIG-IP WebAccelerator: 11.2.1 - 12.1.2

BIG-IP WebSafe: 11.2.1 - 12.1.2

CPE2.3

External links

https://support.f5.com/csp/article/K19361245

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.