F5 BIG-IP up to 12.1.3.7/13.1.1.1/14.0.0.2 TMUI command injection

Summaryinfo

A vulnerability marked as critical has been reported in F5 BIG-IP up to 12.1.3.7/13.1.1.1/14.0.0.2. The impacted element is an unknown function of the component TMUI. Performing a manipulation results in command injection. This vulnerability was named CVE-2018-15329. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in F5 BIG-IP up to 12.1.3.7/13.1.1.1/14.0.0.2 (Firewall Software). This affects an unknown code of the component TMUI. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

The bug was discovered 12/21/2018. The weakness was presented 12/20/2018 (Website). It is possible to read the advisory at support.f5.com. This vulnerability is uniquely identified as CVE-2018-15329 since 08/14/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. A authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 119820 (F5 Networks BIG-IP : TMUI vulnerability (K61620494)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family F5 Networks Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (119820). See VDB-128224 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 12.1.3.0
• 12.1.3.1
• 12.1.3.2
• 12.1.3.3
• 12.1.3.4
• 12.1.3.5
• 12.1.3.6
• 12.1.3.7
• 13.1.1.0
• 13.1.1.1
• 14.0.0.0
• 14.0.0.1
• 14.0.0.2

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion