PT-2018-17034 · F5 · Enterprise Manager+4

Publicado 2018-07-19 · Atualizado 2019-10-03 · CVE-2018-5540

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.0.0 through 13.0.1 F5 BIG-IP versions 12.1.0 through 12.1.3.3 F5 BIG-IP versions 11.6.0 through 11.6.3.1 F5 BIG-IP versions 11.5.1 through 11.5.6 Enterprise Manager version 3.1.1 BIG-IQ Centralized Management versions 5.0.0 through 5.1.0 BIG-IQ Cloud and Orchestration version 1.0.0 F5 iWorkflow versions 2.1.0 through 2.3.0

Description The issue arises because the big3d process does not properly minimize group privileges at startup.

Recommendations For F5 BIG-IP versions 13.0.0 through 13.0.1, consider updating to a version where the big3d process properly minimizes group privileges. For F5 BIG-IP versions 12.1.0 through 12.1.3.3, consider updating to a version where the big3d process properly minimizes group privileges. For F5 BIG-IP versions 11.6.0 through 11.6.3.1, consider updating to a version where the big3d process properly minimizes group privileges. For F5 BIG-IP versions 11.5.1 through 11.5.6, consider updating to a version where the big3d process properly minimizes group privileges. For Enterprise Manager version 3.1.1, consider updating to a version where the big3d process properly minimizes group privileges. For BIG-IQ Centralized Management versions 5.0.0 through 5.1.0, consider updating to a version where the big3d process properly minimizes group privileges. For BIG-IQ Cloud and Orchestration version 1.0.0, consider updating to a version where the big3d process properly minimizes group privileges. For F5 iWorkflow versions 2.1.0 through 2.3.0, consider updating to a version where the big3d process properly minimizes group privileges.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-5540

Produtos afetados

Big-Iq Centralized Management

Big-Iq Cloud/Orchestration

Enterprise Manager

F5 Big-Ip

F5 Iworkflow

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-5540 · Aviso do Fabricante
• https://support.f5.com/csp/article/K82038789 · Aviso do Fabricante
• http://securityfocus.com/bid/104920 · Nota
• http://securitytracker.com/id/1041340 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-5540 · Nota de Segurança
• http://securitytracker.com/id/1041341 · Nota