#VU12806 Improper resource shutdown in F5 Networks products - CVE-2018-5507

Vulnerability identifier: #VU12806

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2018-5507

CWE-ID: CWE-404

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerable software:
BIG-IP LTM
BIG-IP AFM
BIG-IP APM
BIG-IP ASM
BIG-IP PEM
BIG-IP AAM
BIG-IP Link Controller
BIG-IP WebSafe

Software vendor:
F5 Networks

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to incorrect decryption of ciphertext from established SSL sessions with small MTU. An adjacent attacker can cause the service to crash.

Update to versions 11.5.6, 11.6.3, 12.1.3.2, 13.0.1 or 13.1.0.

• https://support.f5.com/csp/article/K52521791