Buffer overflow in cURL component in F5 Networks products
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-5482 |
| CWE-ID | CWE-122 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
BIG-IP PEM Hardware solutions / Security hardware applicances BIG-IP GTM Hardware solutions / Security hardware applicances BIG-IP FPS Hardware solutions / Security hardware applicances BIG-IP ASM Hardware solutions / Security hardware applicances BIG-IP Analytics Hardware solutions / Security hardware applicances BIG-IP LTM Hardware solutions / Security hardware applicances BIG-IP Link Controller Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP DNS Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP AAM Hardware solutions / Routers & switches, VoIP, GSM, etc BIG-IP Hardware solutions / Firmware BIG-IP SSLO Hardware solutions / Firmware BIG-IP DDHD Hardware solutions / Firmware BIG-IP Advanced WAF Client/Desktop applications / Antivirus software/Personal firewalls BIG-IQ Centralized Management Server applications / Remote management servers, RDP, SSH Traffix SDC Client/Desktop applications / Software for system administration |
| Vendor | F5 Networks |
Security Bulletin
This security bulletin contains information about 1 vulnerabilities.
The vulnerability is present in the cURL utility, used by remote Installation methods and custom iRules.
1) Heap-based buffer overflow
EUVDB-ID: #VU21059
Risk: Medium
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-5482
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the tftp_receive_packet() function when processing TFTP data. A remote attacker can send specially crafted TFTP response to the vulnerable curl client, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall update from vendor's website.
Vulnerable software versionsBIG-IP PEM: 11.6.1 - 16.0.1.1
BIG-IP Link Controller: 11.6.1 - 16.0.1.1
BIG-IP GTM: 11.6.1 - 16.0.1.1
BIG-IP FPS: 11.6.1 - 16.0.1.1
BIG-IP DNS: 11.6.1 - 16.0.1.1
BIG-IP ASM: 11.6.1 - 16.0.1.1
BIG-IP Analytics: 11.6.1 - 16.0.1.1
BIG-IP AAM: 11.6.1 - 16.0.1.1
BIG-IP LTM: 11.6.1 - 16.0.1.1
BIG-IP: 11.6.1 - 16.0.1.1
BIG-IP SSLO: 11.6.1 - 16.0.1
BIG-IP DDHD: 11.6.1 - 16.0.1
BIG-IP Advanced WAF: 11.6.1 - 16.0.1
BIG-IQ Centralized Management: 5.4.0 - 7.0.0
Traffix SDC: 5.1.0
CPE2.3- cpe:2.3:h:f5_networks:big-ip_pem:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_pem:11.6.1 HF1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_pem:11.6.2:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_link_controller:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_link_controller:11.6.1 HF1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_link_controller:11.6.2:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_gtm:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_gtm:11.6.1 HF1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_gtm:11.6.2:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_fps:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_dns:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_asm:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_analytics:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_aam:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_ltm:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_sslo:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:h:f5_networks:big-ip_ddhd:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5_networks:big-ip_advanced_waf:11.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:f5_networks:big-iq:5.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:f5_networks:traffix_sdc:5.1.0:*:*:*:*:*:*:*
https://support.f5.com/csp/article/K41523201
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
