F5 BIG-IP up to 14.0.0.2 tmsh /var access control

Summaryinfo

A vulnerability labeled as problematic has been found in F5 BIG-IP up to 11.5.6/11.6.3.2/12.1.3.5/13.1.0.7/14.0.0.2. This vulnerability affects unknown code of the file /var of the component tmsh. The manipulation results in access control. This vulnerability is known as CVE-2018-15322. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in F5 BIG-IP up to 11.5.6/11.6.3.2/12.1.3.5/13.1.0.7/14.0.0.2 (Firewall Software). Affected is an unknown part of the file /var of the component tmsh. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on availability. CVE summarizes:

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 6.0.0-6.0.1, 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.0.1-2.3.0, or Enterprise Manager 3.1.1 a BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service (DoS) when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This action utilises storage space on the /var partition and when performed repeatedly causes the /var partition to be full.

The bug was discovered 10/31/2018. The weakness was published 10/30/2018 (Website). The advisory is shared for download at support.f5.com. This vulnerability is traded as CVE-2018-15322 since 08/14/2018. It is possible to launch the attack remotely. A authentication is necessary for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 118650 (F5 Networks BIG-IP : tmsh utility vulnerability (K28003839)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family F5 Networks Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371354 (F5 BIG-IP ASM,LTM,APM tmsh utility Denial of Service Vulnerability (K28003839)).

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (118650). Similar entries are available at VDB-126363, VDB-126361, VDB-126359 and VDB-126358. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.5.4
• 11.5.5
• 11.5.6
• 11.6.3.0
• 11.6.3.1
• 11.6.3.2
• 12.1.3.0
• 12.1.3.1
• 12.1.3.2
• 12.1.3.3
• 12.1.3.4
• 12.1.3.5
• 13.1.0.0
• 13.1.0.1
• 13.1.0.2
• 13.1.0.3
• 13.1.0.4
• 13.1.0.5
• 13.1.0.6
• 13.1.0.7
• 14.0.0.0
• 14.0.0.1
• 14.0.0.2

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion