CVE-2018-5507: High severity F5 Big-ip Local Traffic Manager vulnerability
Published Apr 13, 2018
·Updated
On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU.
Affected Software
146 affected components
F5 Big-ip Local Traffic Manager>=11.5.1<=11.5.5
F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.2
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3
F5 Big-ip Local Traffic Manager=13.0.0
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
F5 Big-ip Application Acceleration Manager>=11.5.1<=11.5.5
F5 Big-ip Application Acceleration Manager>=11.6.1<=11.6.2
F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3
F5 Big-ip Application Acceleration Manager=13.0.0
F5 BIG-IP Advanced Firewall Manager>=11.5.1<=11.5.5
F5 BIG-IP Advanced Firewall Manager>=11.6.1<=11.6.2
F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3
F5 BIG-IP Advanced Firewall Manager=13.0.0
F5 BIG-IP Analytics>=11.5.1<=11.5.5
F5 BIG-IP Analytics>=11.6.1<=11.6.2
F5 BIG-IP Analytics>=12.1.0<=12.1.3
F5 BIG-IP Analytics=13.0.0
F5 BIG-IP Access Policy Manager>=11.5.1<=11.5.5
F5 BIG-IP Access Policy Manager>=11.6.1<=11.6.2
F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3
F5 BIG-IP Access Policy Manager=13.0.0
F5 BIG-IP Application Security Manager>=11.5.1<=11.5.5
F5 BIG-IP Application Security Manager>=11.6.1<=11.6.2
F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3
F5 BIG-IP Application Security Manager=13.0.0
F5 BIG-IP Edge Gateway>=11.5.1<=11.5.5
F5 BIG-IP Edge Gateway>=11.6.1<=11.6.2
F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3
F5 BIG-IP Edge Gateway=13.0.0
F5 Big-ip Global Traffic Manager>=11.5.1<=11.5.5
F5 Big-ip Global Traffic Manager>=11.6.1<=11.6.2
F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3
F5 Big-ip Global Traffic Manager=13.0.0
F5 Big-ip Link Controller>=11.5.1<=11.5.5
F5 Big-ip Link Controller>=11.6.1<=11.6.2
F5 Big-ip Link Controller>=12.1.0<=12.1.3
F5 Big-ip Link Controller=13.0.0
F5 Big-ip Policy Enforcement Manager>=11.5.1<=11.5.5
F5 Big-ip Policy Enforcement Manager>=11.6.1<=11.6.2
F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3
F5 Big-ip Policy Enforcement Manager=13.0.0
F5 Big-ip Webaccelerator>=11.5.1<=11.5.5
F5 Big-ip Webaccelerator>=11.6.1<=11.6.2
F5 Big-ip Webaccelerator>=12.1.0<=12.1.3
F5 Big-ip Webaccelerator=13.0.0
F5 Big-ip Websafe>=11.5.1<=11.5.5
F5 Big-ip Websafe>=11.6.1<=11.6.2
F5 Big-ip Websafe>=12.1.0<=12.1.3
F5 Big-ip Websafe=13.0.0
F5 Big-ip Domain Name System>=11.5.1<=11.5.5
F5 Big-ip Domain Name System>=11.6.1<=11.6.2
F5 Big-ip Domain Name System>=12.1.0<=12.1.3
F5 Big-ip Domain Name System=13.0.0
All of the following
Any of the following
F5 Big-ip Local Traffic Manager>=11.5.1<=11.5.5
F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.2
F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3
F5 Big-ip Local Traffic Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Application Acceleration Manager>=11.5.1<=11.5.5
F5 Big-ip Application Acceleration Manager>=11.6.1<=11.6.2
F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3
F5 Big-ip Application Acceleration Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 BIG-IP Advanced Firewall Manager>=11.5.1<=11.5.5
F5 BIG-IP Advanced Firewall Manager>=11.6.1<=11.6.2
F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3
F5 BIG-IP Advanced Firewall Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 BIG-IP Analytics>=11.5.1<=11.5.5
F5 BIG-IP Analytics>=11.6.1<=11.6.2
F5 BIG-IP Analytics>=12.1.0<=12.1.3
F5 BIG-IP Analytics=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 BIG-IP Access Policy Manager>=11.5.1<=11.5.5
F5 BIG-IP Access Policy Manager>=11.6.1<=11.6.2
F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3
F5 BIG-IP Access Policy Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 BIG-IP Application Security Manager>=11.5.1<=11.5.5
F5 BIG-IP Application Security Manager>=11.6.1<=11.6.2
F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3
F5 BIG-IP Application Security Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 BIG-IP Edge Gateway>=11.5.1<=11.5.5
F5 BIG-IP Edge Gateway>=11.6.1<=11.6.2
F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3
F5 BIG-IP Edge Gateway=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Global Traffic Manager>=11.5.1<=11.5.5
F5 Big-ip Global Traffic Manager>=11.6.1<=11.6.2
F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3
F5 Big-ip Global Traffic Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Link Controller>=11.5.1<=11.5.5
F5 Big-ip Link Controller>=11.6.1<=11.6.2
F5 Big-ip Link Controller>=12.1.0<=12.1.3
F5 Big-ip Link Controller=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Policy Enforcement Manager>=11.5.1<=11.5.5
F5 Big-ip Policy Enforcement Manager>=11.6.1<=11.6.2
F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3
F5 Big-ip Policy Enforcement Manager=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Webaccelerator>=11.5.1<=11.5.5
F5 Big-ip Webaccelerator>=11.6.1<=11.6.2
F5 Big-ip Webaccelerator>=12.1.0<=12.1.3
F5 Big-ip Webaccelerator=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Websafe>=11.5.1<=11.5.5
F5 Big-ip Websafe>=11.6.1<=11.6.2
F5 Big-ip Websafe>=12.1.0<=12.1.3
F5 Big-ip Websafe=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
All of the following
Any of the following
F5 Big-ip Domain Name System>=11.5.1<=11.5.5
F5 Big-ip Domain Name System>=11.6.1<=11.6.2
F5 Big-ip Domain Name System>=12.1.0<=12.1.3
F5 Big-ip Domain Name System=13.0.0
Any of the following
F5 Viprion 2100 Blades
F5 Viprion 4200 Blades
F5 Viprion 4300 Blades
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For F5 BIG-IP vCMP guests on VIPRION 2100, 4200, and 4300 series blades that run BIG-IP 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, mitigate the small-MTU SSL session decryption issue affecting established SSL sessions by adjusting the network MTU to avoid small MTU conditions for those vCMP guest traffic.
Event History
Apr 13, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionWeakness
Data Sourced
via NVD·01:29 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-5507?
The severity of CVE-2018-5507 is categorized as high due to its potential impact on SSL session decryption.
2
How do I fix CVE-2018-5507?
To fix CVE-2018-5507, upgrade F5 BIG-IP software to versions that are not vulnerable, such as those beyond 13.0.0, 12.1.3.1, 11.6.2, and 11.5.5.
3
Which versions of F5 BIG-IP are affected by CVE-2018-5507?
CVE-2018-5507 affects F5 BIG-IP versions 13.0.0, 12.1.0 through 12.1.3.1, 11.6.1 through 11.6.2, and 11.5.1 through 11.5.5.
4
What types of systems are vulnerable to CVE-2018-5507?
Systems running F5 BIG-IP Local Traffic Manager, Application Acceleration Manager, Advanced Firewall Manager, and several other modules are vulnerable to CVE-2018-5507.
5
What are the implications of CVE-2018-5507?
The implications of CVE-2018-5507 include the inability to properly decrypt SSL session data, potentially compromising secure communications.