A vulnerability was found in F5 BIG-IP up to 13.1.0.7 (Firewall Software). It has been rated as problematic. This issue affects an unknown code block of the component Traffic Management Microkernel. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel (tmm) to leak memory. As a result, system memory usage increases over time, which may eventually cause a decrease in performance or a system reboot due to memory exhaustion.

The bug was discovered 06/27/2018. The weakness was released 06/27/2018 (Website). The advisory is shared at support.f5.com. The identification of this vulnerability is CVE-2018-5527 since 01/12/2018. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 118637 (F5 Networks BIG-IP : SSL Forward Proxy vulnerability (K20134942)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family F5 Networks Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371031 (F5 BIG-IP ASM SSL Forward Proxy vulnerability (K20134942)).

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (118637). Entry connected to this vulnerability is available at 120042.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 13.1.0
• 13.1.0.1
• 13.1.0.2
• 13.1.0.3
• 13.1.0.4
• 13.1.0.5
• 13.1.0.6
• 13.1.0.7

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion