F5 BIG-IP up to 12.1.0 Virtual Server cryptographic issue

Summaryinfo

A vulnerability marked as critical has been reported in F5 BIG-IP up to 12.1.0. Affected by this vulnerability is an unknown functionality of the component Virtual Server. The manipulation leads to cryptographic issue. This vulnerability is traded as CVE-2019-6593. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in F5 BIG-IP up to 12.1.0 (Firewall Software). It has been rated as critical. This issue affects an unknown code of the component Virtual Server. The manipulation with an unknown input leads to a cryptographic issue vulnerability. Using CWE to declare the problem leads to CWE-310. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)

The bug was discovered 02/26/2019. The weakness was shared 02/26/2019. The identification of this vulnerability is CVE-2019-6593 since 01/22/2019. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/19/2023). The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371722 (F5 BIG-IP ASM,LTM,APM Virtual Server TLS Man-in-the-Middle Attack Information Disclosure Vulnerability(K10065173)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-131220 and VDB-131218 are related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 11.5.1
• 11.5.2
• 11.5.3
• 11.5.4
• 11.6.1
• 12.1.0

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion