PT-2020-18782 · F5 · Big-Ip Virtual Edition

Published 2020-04-30 · Updated 2020-05-07 · CVE-2020-5881

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP Virtual Edition (VE) versions 13.1.0 through 13.1.3.3 BIG-IP Virtual Edition (VE) versions 14.1.0 through 14.1.2.3 BIG-IP Virtual Edition (VE) versions 15.0.0 through 15.1.0.1

Description When the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up, disrupting the communication between the mcpd and tmm processes.

Recommendations For versions 13.1.0 through 13.1.3.3, consider disabling the VLAN groups configuration as a temporary workaround until a patch is available. For versions 14.1.0 through 14.1.2.3, restrict access to the NDAL Interfaces to minimize the risk of exploitation. For versions 15.0.0 through 15.1.0.1, avoid using OSPF with devices connected to the BIG-IP Virtual Edition (VE) until the issue is resolved.

Fix

Related Identifiers

CVE-2020-5881

Affected Products

Big-Ip Virtual Edition

References · 4

• https://osv.dev/vulnerability/CVE-2020-5881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5881 · Security Note
• https://support.f5.com/csp/article/K03386032 · Vendor Advisory
• https://t.me/cvenotify/3468 · Telegram Post