PT-2018-17013 · F5 · F5 Big-Ip

Published 2018-05-02 · Updated 2019-10-03 · CVE-2018-5519

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.3 F5 BIG-IP versions 13.0.0 through 13.1.0.5

Description Administrative users can exploit the ssldump utility to write to arbitrary file paths using undisclosed methods. This issue allows more permissive file access than intended for users without Advanced Shell access, such as those licensed for Appliance Mode.

Recommendations For F5 BIG-IP versions 11.2.1 through 11.6.3.1, restrict access to the ssldump utility to minimize the risk of exploitation. For F5 BIG-IP versions 12.1.0 through 12.1.3.3, consider disabling the ssldump utility until a patch is available. For F5 BIG-IP versions 13.0.0 through 13.1.0.5, limit file access permissions to prevent arbitrary file path writing.

Fix

Related Identifiers

CVE-2018-5519

Affected Products

F5 Big-Ip

References · 4

• https://osv.dev/vulnerability/CVE-2018-5519 · Vendor Advisory
• https://support.f5.com/csp/article/K46121888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5519 · Security Note
• http://securitytracker.com/id/1040803 · Note