PT-2018-17014 · F5 · F5 Big-Ip

Published 2018-05-02 · Updated 2020-08-24 · CVE-2018-5520

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1 through 11.6.3.1 F5 BIG-IP versions 12.1.0 through 12.1.3.1 F5 BIG-IP versions 13.0.0 through 13.1.0.5

Description The issue allows an administrative user to gain unauthorized access to file system resources using the dig utility in the TMOS Shell (tmsh) on systems configured in Appliance mode.

Recommendations For F5 BIG-IP versions 11.2.1 through 11.6.3.1, restrict access to the tmsh utility to minimize the risk of exploitation. For F5 BIG-IP versions 12.1.0 through 12.1.3.1, consider disabling the dig utility in the TMOS Shell until a fix is available. For F5 BIG-IP versions 13.0.0 through 13.1.0.5, limit the use of the tmsh utility to only necessary administrative tasks to reduce the risk of unauthorized access.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-5520

Affected Products

F5 Big-Ip

References · 4

• https://osv.dev/vulnerability/CVE-2018-5520 · Vendor Advisory
• https://support.f5.com/csp/article/K02043709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5520 · Security Note
• http://securitytracker.com/id/1040798 · Note