Detections
Analytics

F5 Networks BIG-IP : BIG-IP SSL/TLS ADH/DHE vulnerability (K91158923)

medium Nessus Plugin ID 140470

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a virtual server configured with a Client SSL profile, and using AnonymousDiffie-Hellman (ADH) or Ephemeral Diffie-Hellman(DHE) key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/Transport Layer Security (TLS) handshakes that may result with a pre-master secret (PMS)that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle.
Differences in processing time when the PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability. (CVE-2020-5929)

Impact

Exploiting this vulnerability requires multiple crafted SSL/TLS handshakes to the vulnerable BIG-IP virtual server. This vulnerability may make it possible to recover the shared secret of past sessions and perform plaintext recovery of encrypted messages.Only SSL/TLS sessions established using cipher suites that use ADH or DHEkey exchange are vulnerable to this attack. Captured SSL/TLS sessions encrypted with cipher suites using the RSA key exchange are not at risk for subsequent decryption due to this vulnerability.

This vulnerability affects BIG-IP systems with virtual servers associated with a Client SSL profile and only if all of the following conditions are met :

You are using ADH or DHE key exchange in the Client SSL profile. Note :DHE is enabled by defaultin the DEFAULT cipher suite. ADH is not available in the DEFAULT cipher suite.

You have not enabled the Single Diffie-Hellman use optionor Single DH use optionin the Client SSL profile. Note : The Single DHuse optionis not enabled by default in the Client SSL profile options list.

Your BIG-IP platform has a Cavium Nitrox SSL hardware acceleration card installed. Platforms with this installed include: BIG-IP i11400-DS, i11600-DS, i11800-DS

BIG-IP 800, 1600, 3600, 3900, 5000, 6900, 7000, 8900, 10000, 11000, 12000

VIPRION 2100, 2150, 2250, 4100, 4200, 4300

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K91158923.

See Also

https://my.f5.com/manage/s/article/K91158923

Plugin Details

Severity: Medium

ID: 140470

File Name: f5_bigip_SOL91158923.nasl

Version: 1.9

Type: local

Published: 9/10/2020

Updated: 11/3/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2020-5929

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_domain_name_system, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/h:f5:big-ip

Required KB Items: Host/local_checks_enabled, Settings/ParanoidReport, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version

Exploit Ease: No known exploits are available

Patch Publication Date: 9/9/2020

Vulnerability Publication Date: 9/25/2020

Reference Information

CVE: CVE-2020-5929

IAVA: 2020-A-0395-S