PT-2018-17034 · F5 · Enterprise Manager+4

Published 2018-07-19 · Updated 2019-10-03 · CVE-2018-5540

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.0.0 through 13.0.1 F5 BIG-IP versions 12.1.0 through 12.1.3.3 F5 BIG-IP versions 11.6.0 through 11.6.3.1 F5 BIG-IP versions 11.5.1 through 11.5.6 Enterprise Manager version 3.1.1 BIG-IQ Centralized Management versions 5.0.0 through 5.1.0 BIG-IQ Cloud and Orchestration version 1.0.0 F5 iWorkflow versions 2.1.0 through 2.3.0

Description The issue arises because the big3d process does not properly minimize group privileges at startup.

Recommendations For F5 BIG-IP versions 13.0.0 through 13.0.1, consider updating to a version where the big3d process properly minimizes group privileges. For F5 BIG-IP versions 12.1.0 through 12.1.3.3, consider updating to a version where the big3d process properly minimizes group privileges. For F5 BIG-IP versions 11.6.0 through 11.6.3.1, consider updating to a version where the big3d process properly minimizes group privileges. For F5 BIG-IP versions 11.5.1 through 11.5.6, consider updating to a version where the big3d process properly minimizes group privileges. For Enterprise Manager version 3.1.1, consider updating to a version where the big3d process properly minimizes group privileges. For BIG-IQ Centralized Management versions 5.0.0 through 5.1.0, consider updating to a version where the big3d process properly minimizes group privileges. For BIG-IQ Cloud and Orchestration version 1.0.0, consider updating to a version where the big3d process properly minimizes group privileges. For F5 iWorkflow versions 2.1.0 through 2.3.0, consider updating to a version where the big3d process properly minimizes group privileges.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-5540

Affected Products

Big-Iq Centralized Management

Big-Iq Cloud/Orchestration

Enterprise Manager

F5 Big-Ip

F5 Iworkflow

References · 6

• https://osv.dev/vulnerability/CVE-2018-5540 · Vendor Advisory
• https://support.f5.com/csp/article/K82038789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5540 · Security Note
• http://securityfocus.com/bid/104920 · Note
• http://securitytracker.com/id/1041340 · Note
• http://securitytracker.com/id/1041341 · Note