DNS Rebinding in several F5 Networks products

1) Reliance on Reverse DNS Resolution for a Security-Critical Action

EUVDB-ID: #VU22978

Risk: Low

CVSSv3.1: 3.1 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-6663

CWE-ID: CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action

Exploit availability: No

Description

The vulnerability allows a local user to perform an Anti DNS Pinning (DNS Rebinding) attack.

The vulnerability exists due to the Configuration utility does not sufficiently verify the Host field in the HTTP request. A local user initiating a DNS rebinding attack requires control of the DNS that is configured in a client that accesses the Configuration utility of the vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Enterprise Manager: 3.1.1

BIG-IQ Centralized Management: 5.2.0 - 7.0.0

F5 iWorkflow: 2.3.0

BIG-IP AAM: 11.5.2 - 15.0.1

BIG-IP AFM: 11.5.2 - 15.0.1

BIG-IP Analytics: 11.5.2 - 15.0.1

BIG-IP APM: 11.5.2 - 15.0.1

BIG-IP ASM: 11.5.2 - 15.0.1

BIG-IP DNS: 11.5.2 - 15.0.1

BIG-IP Edge Gateway: 11.5.2 - 15.0.1

BIG-IP FPS: 11.5.2 - 15.0.1

BIG-IP GTM: 11.5.2 - 15.0.1

BIG-IP Link Controller: 11.5.2 - 15.0.1

BIG-IP PEM: 11.5.2 - 15.0.1

BIG-IP WebAccelerator: 11.5.2 - 15.0.1

BIG-IP: 11.5.2 - 15.0.1

External links

http://support.f5.com/csp/article/K76052144

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.