F5 Networks BIG-IP : TMM vulnerability (K64208870)

high Nessus Plugin ID 118689

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

Malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default 'normalize URI' configuration options used in iRules and/or BIG-IP LTM policies. (CVE-2018-15319)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group. This vulnerability affects systems with any of the following configurations :

A virtual server associated with an HTTP profile and a local traffic policy that has a rule condition with the HTTP URI and Use normalized URI options enabled (the Use normalized URI option is disabled by default).

For example, in the following configuration excerpt, the local traffic policy is vulnerable :

ltm policy /Common/K64208870 {

requires { http } rules { vulnerable { conditions { 0 { http-uri path normalized values { /exploitable } } } } } strategy /Common/first-match }

A virtual server associated with an HTTP profile and an iRule using any of the following iRules commands with the -normalized switch:
HTTP::uri

HTTP::query

HTTP::path

For example :

when HTTP_REQUEST { if { ([HTTP::uri -normalized] starts_with '/exploitable')} { log local0.error 'K64208870 URI example' } elseif { ([HTTP::query -normalized] starts_with '/exploitable')} { log local0.error 'K64208870 Query example' } elseif { ([HTTP::path

-normalized] starts_with '/exploitable')} { log local0.error 'K64208870 Path example' } }

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K64208870.

Plugin Details

Severity: High

ID: 118689

File Name: f5_bigip_SOL64208870.nasl

Version: 1.6

Type: local

Family: F5 Networks Local Security Checks

Published: 11/2/2018

Updated: 11/2/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2018-15319

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_domain_name_system, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip

Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 10/30/2018

Vulnerability Publication Date: 10/31/2018

Reference Information

CVE: CVE-2018-15319

Detections

Analytics