ID

VAR-201804-1267


CVE

CVE-2018-5506


TITLE

F5 BIG-IP Product Apache module Vulnerabilities related to certificate and password management

Trust: 0.8

sources: JVNDB: JVNDB-2018-004181

DESCRIPTION

In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager (EM) and managed BIG-IP devices. F5 BIG-IP Product Apache module Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. F5BIG-IPLTM and other products are products of American F5 Company. F5BIG-IPLTM is a local traffic manager; BIG-IPAAM is an application acceleration manager. Both apache_auth_token_mod and mod_auth_f5_auth_token.cpp are modules in it. Apache_auth_token_mod is an anti-theft chain module. Mod_auth_f5_auth_token.cpp is an authentication module. There are security vulnerabilities in the apache_auth_token_mod and mod_auth_f5_auth_token.cppApache modules in several F5 products. F5 BIG-IP LTM, etc. The following products and versions are affected: F5 BIG-IP LTM Release 13.0.0, Release 12.1.0 to Release 12.1.2, Release 11.6.1, Release 11.5.1 to Release 11.5.5, Release 11.2.1; BIG-IP AAM 13.0.0, 12.1.0 to 12.1.2, 11.6.1, 11.5.1 to 11.5.5, 11.2.1; BIG-IP AFM 13.0.0, 12.1.0 to Version 12.1.2, Version 11.6.1, Version 11.5.1 through Version 11.5.5, Version 11.2.1; BIG-IP Analytics Version 13.0.0, Version 12.1.0 through Version 12.1.2, Version 11.6.1, Version 11.5 .1 to 11.5.5, 11.2.1; BIG-IP APM 13.0.0, 12.1.0 to 12.1.2, 11.6.1, 11.5.1 to 11.5.5, 11.2. 1 release; BIG-IP ASM release 13.0.0, release 12.1.0 to release 12.1.2, release 11.6.1, release 11.5.1 to release 11.5.5, release 11.2.1; BIG-IP DNS release 13.0.0 , version 12.1.0 to version 12.1.2, 11

Trust: 2.25

sources: NVD: CVE-2018-5506 // JVNDB: JVNDB-2018-004181 // CNVD: CNVD-2018-09409 // VULHUB: VHN-135537

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-09409

AFFECTED PRODUCTS

vendor:f5model:big-ip domain name systemscope:eqversion:11.2.1

Trust: 2.4

vendor:f5model:big-ip domain name systemscope:eqversion:11.6.1

Trust: 2.4

vendor:f5model:big-ip domain name systemscope:eqversion:13.0.0

Trust: 2.4

vendor:f5model:big-ip websafescope:eqversion:13.0.0

Trust: 2.4

vendor:f5model:big-ip access policy managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip access policy managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip access policy managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip analyticsscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip analyticsscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip analyticsscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip application security managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip application security managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip application security managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip edge gatewayscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip global traffic managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip link controllerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip link controllerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip link controllerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip local traffic managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.0

Trust: 1.8

vendor:f5model:big-ip websafescope:eqversion:11.2.1

Trust: 1.8

vendor:f5model:big-ip websafescope:eqversion:11.6.1

Trust: 1.8

vendor:f5model:big-ip analyticsscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip websafescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip websafescope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip websafescope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip websafescope:lteversion:11.5.5

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.3.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip analyticsscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip application security managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip link controllerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ip websafescope:eqversion:11.5.1 to 11.5.5

Trust: 0.8

vendor:f5model:big-ip websafescope:eqversion:12.1.0 to 12.1.3.1

Trust: 0.8

vendor:f5model:big-ipscope:gteversion:12.1.0,<=12.1.2

Trust: 0.6

vendor:f5model:big-ipscope:eqversion:11.2.1

Trust: 0.6

vendor:f5model:big-ipscope:eqversion:13.0.0

Trust: 0.6

vendor:f5model:big-ipscope:gteversion:11.5.1,<=11.5.5

Trust: 0.6

vendor:f5model:big-ipscope:eqversion:11.6.1

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.4

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.1

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.3

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.1

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.0

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.2

Trust: 0.6

sources: CNVD: CNVD-2018-09409 // JVNDB: JVNDB-2018-004181 // CNNVD: CNNVD-201804-706 // NVD: CVE-2018-5506

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5506
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-5506
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-09409
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201804-706
value: CRITICAL

Trust: 0.6

VULHUB: VHN-135537
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-5506
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-09409
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-135537
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5506
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-09409 // VULHUB: VHN-135537 // JVNDB: JVNDB-2018-004181 // CNNVD: CNNVD-201804-706 // NVD: CVE-2018-5506

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-255

Trust: 0.9

sources: VULHUB: VHN-135537 // JVNDB: JVNDB-2018-004181 // NVD: CVE-2018-5506

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201804-706

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201804-706

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-004181

PATCH

title:K65355492url:https://support.f5.com/csp/article/K65355492

Trust: 0.8

title:Patches for various F5 products apache_auth_token_mod and mod_auth_f5_auth_token.cppApache module brute force exploitsurl:https://www.cnvd.org.cn/patchInfo/show/128791

Trust: 0.6

title:Multiple F5 product apache_auth_token_mod and mod_auth_f5_auth_token.cpp Apache Repair measures for module security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80115

Trust: 0.6

sources: CNVD: CNVD-2018-09409 // JVNDB: JVNDB-2018-004181 // CNNVD: CNNVD-201804-706

EXTERNAL IDS

db:NVDid:CVE-2018-5506

Trust: 3.1

db:JVNDBid:JVNDB-2018-004181

Trust: 0.8

db:CNVDid:CNVD-2018-09409

Trust: 0.6

db:CNNVDid:CNNVD-201804-706

Trust: 0.6

db:VULHUBid:VHN-135537

Trust: 0.1

sources: CNVD: CNVD-2018-09409 // VULHUB: VHN-135537 // JVNDB: JVNDB-2018-004181 // CNNVD: CNNVD-201804-706 // NVD: CVE-2018-5506

REFERENCES

url:https://support.f5.com/csp/article/k65355492

Trust: 2.3

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5506

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-5506

Trust: 0.8

sources: CNVD: CNVD-2018-09409 // VULHUB: VHN-135537 // JVNDB: JVNDB-2018-004181 // CNNVD: CNNVD-201804-706 // NVD: CVE-2018-5506

SOURCES

db:CNVDid:CNVD-2018-09409
db:VULHUBid:VHN-135537
db:JVNDBid:JVNDB-2018-004181
db:CNNVDid:CNNVD-201804-706
db:NVDid:CVE-2018-5506

LAST UPDATE DATE

2024-11-23T22:00:36.085000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2018-09409date:2018-05-14T00:00:00
db:VULHUBid:VHN-135537date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2018-004181date:2018-06-13T00:00:00
db:CNNVDid:CNNVD-201804-706date:2019-10-23T00:00:00
db:NVDid:CVE-2018-5506date:2024-11-21T04:08:56.600

SOURCES RELEASE DATE

db:CNVDid:CNVD-2018-09409date:2018-05-14T00:00:00
db:VULHUBid:VHN-135537date:2018-04-13T00:00:00
db:JVNDBid:JVNDB-2018-004181date:2018-06-13T00:00:00
db:CNNVDid:CNNVD-201804-706date:2018-04-16T00:00:00
db:NVDid:CVE-2018-5506date:2018-04-13T13:29:00.627