CVE-2018-15329: High severity riverbed steelapp traffic manager vulnerability

Q: What is CVE-2018-15329?

CVE-2018-15329 refers to a vulnerability on BIG-IP and Enterprise Manager where authenticated administrative users may be able to run unauthorized commands.

Q: Which software versions are affected by CVE-2018-15329?

BIG-IP versions between 14.0.0 and 14.0.0.2, 13.0.0 and 13.1.1.1, and 12.1.0 and 12.1.3.7, as well as Enterprise Manager version 3.1.1 are affected by CVE-2018-15329.

Q: What is the severity of CVE-2018-15329?

CVE-2018-15329 has a severity rating of 7.2, which is considered high.

Q: How can I fix CVE-2018-15329?

To fix CVE-2018-15329, F5 recommends upgrading to a patched version of the affected software.

Q: Where can I find more information about CVE-2018-15329?

You can find more information about CVE-2018-15329 at the following link: https://support.f5.com/csp/article/K61620494

Published Dec 20, 2018

Updated

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

Affected Software

40 affected components

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3.7

F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.1.1

F5 Big-ip Local Traffic Manager>=14.0.0<=14.0.0.2

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3.7

F5 Big-ip Application Acceleration Manager>=13.0.0<=13.1.1.1

F5 Big-ip Application Acceleration Manager>=14.0.0<=14.0.0.2

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3.7

F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Advanced Firewall Manager>=14.0.0<=14.0.0.2

F5 BIG-IP Analytics>=12.1.0<=12.1.3.7

F5 BIG-IP Analytics>=13.0.0<=13.1.1.1

F5 BIG-IP Analytics>=14.0.0<=14.0.0.2

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3.7

F5 BIG-IP Access Policy Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Access Policy Manager>=14.0.0<=14.0.0.2

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3.7

F5 BIG-IP Application Security Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Application Security Manager>=14.0.0<=14.0.0.2

F5 Big-ip Domain Name System>=12.1.0<=12.1.3.7

F5 Big-ip Domain Name System>=13.0.0<=13.1.1.1

F5 Big-ip Domain Name System>=14.0.0<=14.0.0.2

F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3.7

F5 BIG-IP Edge Gateway>=13.0.0<=13.1.1.1

F5 BIG-IP Edge Gateway>=14.0.0<=14.0.0.2

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.3.7

F5 Big-ip Fraud Protection Service>=13.0.0<=13.1.1.1

F5 Big-ip Fraud Protection Service>=14.0.0<=14.0.0.2

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3.7

F5 Big-ip Global Traffic Manager>=13.0.0<=13.1.1.1

F5 Big-ip Global Traffic Manager>=14.0.0<=14.0.0.2

F5 Big-ip Link Controller>=12.1.0<=12.1.3.7

F5 Big-ip Link Controller>=13.0.0<=13.1.1.1

F5 Big-ip Link Controller>=14.0.0<=14.0.0.2

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3.7

F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.1.1.1

F5 Big-ip Policy Enforcement Manager>=14.0.0<=14.0.0.2

F5 Big-ip Webaccelerator>=12.1.0<=12.1.3.7

F5 Big-ip Webaccelerator>=13.0.0<=13.1.1.1

F5 Big-ip Webaccelerator>=14.0.0<=14.0.0.2

F5 Enterprise Manager=3.1.1

Event History

Dec 20, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-15329?

CVE-2018-15329 refers to a vulnerability on BIG-IP and Enterprise Manager where authenticated administrative users may be able to run unauthorized commands.

Which software versions are affected by CVE-2018-15329?

BIG-IP versions between 14.0.0 and 14.0.0.2, 13.0.0 and 13.1.1.1, and 12.1.0 and 12.1.3.7, as well as Enterprise Manager version 3.1.1 are affected by CVE-2018-15329.

What is the severity of CVE-2018-15329?

CVE-2018-15329 has a severity rating of 7.2, which is considered high.

How can I fix CVE-2018-15329?

To fix CVE-2018-15329, F5 recommends upgrading to a patched version of the affected software.

Where can I find more information about CVE-2018-15329?