F5 BIG-IP up to 11.6.2/12.1.2 HF/13.0.0 HF2 SSL/TLS Handshake cleartext storage

Summaryinfo

A vulnerability was found in F5 BIG-IP up to 11.6.2/12.1.2 HF/13.0.0 HF2. It has been classified as critical. Affected is an unknown function. Performing a manipulation as part of SSL/TLS Handshake results in cleartext storage. This vulnerability is known as CVE-2020-5929. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in F5 BIG-IP up to 11.6.2/12.1.2 HF/13.0.0 HF2 (Firewall Software). This affects an unknown code block. The manipulation as part of a SSL/TLS Handshake leads to a cleartext storage vulnerability. CWE is classifying the issue as CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. This is going to have an impact on confidentiality. The summary by CVE is:

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.

The weakness was published 09/25/2020 (Website). The advisory is shared at support.f5.com. This vulnerability is uniquely identified as CVE-2020-5929 since 01/06/2020. The exploitability is told to be difficult. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1555 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 11.6.0
• 11.6.1
• 11.6.2
• 12.1.2 HF
• 13.0.0 HF2

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion