CVE-2018-5537: Input Validation

Q: What is the severity of CVE-2018-5537?

The severity of CVE-2018-5537 is medium with a CVSS score of 5.3.

Q: Which versions of F5 BIG-IP are affected by CVE-2018-5537?

F5 BIG-IP versions 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, and 11.2.1-11.5.6 are affected by CVE-2018-5537.

Q: How can a remote attacker exploit CVE-2018-5537?

A remote attacker can exploit CVE-2018-5537 by sending specially prepared HTML content to the TMM virtual server on F5 BIG-IP.

Q: What can happen if the TMM virtual server is configured with a HTML or Rewrite profile on F5 BIG-IP?

If the TMM virtual server is configured with a HTML or Rewrite profile on F5 BIG-IP, a remote attacker may be able to disrupt services or cause TMM to restart while processing certain HTML content from the back end.

Q: How can I fix CVE-2018-5537 on F5 BIG-IP?

To fix CVE-2018-5537 on F5 BIG-IP, update to a version that is not affected by the vulnerability and follow the recommendations provided by F5 Networks.

Published Jul 25, 2018

Updated

A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is configured with a HTML or a Rewrite profile. TMM may restart while processing some specially prepared HTML content from the back end.

Affected Software

40 affected components

F5 Big-ip Local Traffic Manager>=11.2.1<=11.5.6

F5 Big-ip Local Traffic Manager>=11.6.0<=11.6.3.1

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3.5

F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.0.5

F5 Big-ip Application Acceleration Manager>=11.2.1<=11.5.6

F5 Big-ip Application Acceleration Manager>=11.6.0<=11.6.3.1

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3.5

F5 Big-ip Application Acceleration Manager>=13.0.0<=13.1.0.5

F5 BIG-IP Advanced Firewall Manager>=11.2.1<=11.5.6

F5 BIG-IP Advanced Firewall Manager>=11.6.0<=11.6.3.1

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.2

F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.1.0.5

F5 BIG-IP Access Policy Manager>=11.2.1<=11.5.6

F5 BIG-IP Access Policy Manager>=11.6.0<=11.6.3.1

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3.5

F5 BIG-IP Access Policy Manager>=13.0.0<=13.1.0.5

F5 BIG-IP Application Security Manager>=10.1.0<=11.5.6

F5 BIG-IP Application Security Manager>=11.6.0<=11.6.3.1

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3.5

F5 BIG-IP Application Security Manager>=13.0.0<=13.1.0.5

F5 BIG-IP Edge Gateway>=11.2.1<=11.5.6

F5 BIG-IP Edge Gateway>=11.6.0<=11.6.3.1

F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3.5

F5 BIG-IP Edge Gateway>=13.0.0<=13.1.0.5

F5 Big-ip Global Traffic Manager>=11.2.1<=11.5.6

F5 Big-ip Global Traffic Manager>=11.6.0<=11.6.3.1

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3.5

F5 Big-ip Global Traffic Manager>=13.0.0<=13.1.0.5

F5 Big-ip Policy Enforcement Manager>=11.2.1<=11.5.6

F5 Big-ip Policy Enforcement Manager>=11.6.0<=11.6.3.1

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3.5

F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.1.0.5

F5 Big-ip Webaccelerator>=11.2.1<=11.5.6

F5 Big-ip Webaccelerator>=11.6.0<=11.6.3.1

F5 Big-ip Webaccelerator>=12.1.0<=12.1.3.5

F5 Big-ip Webaccelerator>=13.0.0<=13.1.0.5

F5 Big-ip Websafe>=11.2.1<=11.5.6

F5 Big-ip Websafe>=11.6.1<=11.6.3.1

F5 Big-ip Websafe>=12.1.0<=12.1.3.5

F5 Big-ip Websafe>=13.0.0<=13.1.0.5

Event History

Jul 25, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-5537?

The severity of CVE-2018-5537 is medium with a CVSS score of 5.3.

Which versions of F5 BIG-IP are affected by CVE-2018-5537?

F5 BIG-IP versions 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, and 11.2.1-11.5.6 are affected by CVE-2018-5537.

How can a remote attacker exploit CVE-2018-5537?

A remote attacker can exploit CVE-2018-5537 by sending specially prepared HTML content to the TMM virtual server on F5 BIG-IP.

What can happen if the TMM virtual server is configured with a HTML or Rewrite profile on F5 BIG-IP?

If the TMM virtual server is configured with a HTML or Rewrite profile on F5 BIG-IP, a remote attacker may be able to disrupt services or cause TMM to restart while processing certain HTML content from the back end.

How can I fix CVE-2018-5537 on F5 BIG-IP?