Sign-up

ID

VAR-201807-2205


CVE

CVE-2018-5540


TITLE

plural F5 Vulnerabilities related to authorization, authority, and access control in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-008257

DESCRIPTION

On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or 11.5.1-11.5.6, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.1.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.1.0-2.3.0 the big3d process does not irrevocably minimize group privileges at start up. plural F5 The product contains vulnerabilities related to authorization, permissions, and access control.Information may be obtained. F5 BIG-IP big3d Process is prone to a local privilege escalation vulnerability. Local attackers may exploit this issue to gain elevated privileges. F5 BIG-IP and so on are all products of F5 Company in the United States. F5 BIG-IP is an all-in-one network device that integrates functions such as network traffic management, application security management, and load balancing. Enterprise Manager is a tool that provides visibility into the entire BIG-IP application delivery infrastructure and optimizes application performance. Security flaws exist in several F5 products. The vulnerability stems from the fact that the big3d process does not remove elevated group privileges at startup

Trust: 1.98

sources: NVD: CVE-2018-5540 // JVNDB: JVNDB-2018-008257 // BID: 104920 // VULHUB: VHN-135571

AFFECTED PRODUCTS

vendor:f5model:big-iq cloud and orchestrationscope:eqversion:1.0.0

Trust: 1.8

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:enterprise managerscope:eqversion:3.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.3.1

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:5.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.3.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.0.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:iworkflowscope:lteversion:2.3.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.5.6

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.0.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.6.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:5.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.3.3

Trust: 1.0

vendor:f5model:iworkflowscope:gteversion:2.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.3.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.1 to 11.5.6

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:11.6.0 to 11.6.3.1

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.0 to 12.1.3.3

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:13.0.0 to 13.0.1

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.5.1 to 11.5.6

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:11.6.0 to 11.6.3.1

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:12.1.0 to 12.1.3.3

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope:eqversion:13.0.0 to 13.0.1

Trust: 0.8

vendor:f5model:big-iq centralized managementscope:eqversion:5.0.0 to 5.1.0

Trust: 0.8

vendor:f5model:enterprise manager softwarescope:eqversion:3.1.1

Trust: 0.8

vendor:f5model:iworkflowscope:eqversion:2.1.0 to 2.3.0

Trust: 0.8

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.4

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.1

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.3

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.6.0

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:12.1.1

Trust: 0.6

vendor:f5model:big-ip global traffic managerscope:eqversion:11.5.1

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.6.1

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:12.1.0

Trust: 0.6

vendor:f5model:big-ip domain name systemscope:eqversion:11.5.2

Trust: 0.6

vendor:f5model:big-iq centralized managementscope:eqversion:5.1

Trust: 0.3

vendor:f5model:big-iq centralized managementscope:eqversion:5.0

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:13.0.1

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:12.1.3

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:12.1

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:13.0.0

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:13.0.1

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:12.1.3

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.6

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:12.1.0

Trust: 0.3

vendor:f5model:big-iq centralized managementscope:neversion:5.2

Trust: 0.3

vendor:f5model:big-ip gtmscope:neversion:13.1

Trust: 0.3

vendor:f5model:big-ip gtmscope:neversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip gtmscope:neversion:12.1.3.4

Trust: 0.3

vendor:f5model:big-ip gtmscope:neversion:11.6.3.2

Trust: 0.3

vendor:f5model:big-ip dnsscope:neversion:13.1

Trust: 0.3

vendor:f5model:big-ip dnsscope:neversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip dnsscope:neversion:12.1.3.4

Trust: 0.3

vendor:f5model:big-ip dnsscope:neversion:11.6.3.2

Trust: 0.3

sources: BID: 104920 // JVNDB: JVNDB-2018-008257 // CNNVD: CNNVD-201807-1552 // NVD: CVE-2018-5540

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5540
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-5540
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201807-1552
value: MEDIUM

Trust: 0.6

VULHUB: VHN-135571
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-5540
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-135571
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5540
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-135571 // JVNDB: JVNDB-2018-008257 // CNNVD: CNNVD-201807-1552 // NVD: CVE-2018-5540

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.1

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-135571 // JVNDB: JVNDB-2018-008257 // NVD: CVE-2018-5540

THREAT TYPE

local

Trust: 0.9

sources: BID: 104920 // CNNVD: CNNVD-201807-1552

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201807-1552

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-008257

PATCH
title:K82038789url:https://support.f5.com/csp/article/K82038789
Trust: 0.8
title:Multiple F5 Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84105
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-008257 // 
            
            
            
            CNNVD: CNNVD-201807-1552

EXTERNAL IDS
db:NVDid:CVE-2018-5540
Trust: 2.8
db:BIDid:104920
Trust: 2.0
db:SECTRACKid:1041341
Trust: 1.7
db:SECTRACKid:1041340
Trust: 1.7
db:JVNDBid:JVNDB-2018-008257
Trust: 0.8
db:CNNVDid:CNNVD-201807-1552
Trust: 0.7
db:VULHUBid:VHN-135571
Trust: 0.1
sources:
            
            
            VULHUB: VHN-135571 // 
            
            
            
            BID: 104920 // 
            
            
            
            JVNDB: JVNDB-2018-008257 // 
            
            
            
            CNNVD: CNNVD-201807-1552 // 
            
            
            
            NVD: CVE-2018-5540

REFERENCES
url:https://support.f5.com/csp/article/k82038789
Trust: 2.0
url:http://www.securityfocus.com/bid/104920
Trust: 1.7
url:http://www.securitytracker.com/id/1041340
Trust: 1.7
url:http://www.securitytracker.com/id/1041341
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5540
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-5540
Trust: 0.8
url:http://www.f5.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-135571 // 
            
            
            
            BID: 104920 // 
            
            
            
            JVNDB: JVNDB-2018-008257 // 
            
            
            
            CNNVD: CNNVD-201807-1552 // 
            
            
            
            NVD: CVE-2018-5540

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 104920

SOURCES
db:VULHUBid:VHN-135571
db:BIDid:104920
db:JVNDBid:JVNDB-2018-008257
db:CNNVDid:CNNVD-201807-1552
db:NVDid:CVE-2018-5540

LAST UPDATE DATE
2024-11-23T22:34:09.014000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-135571date:2019-10-03T00:00:00
db:BIDid:104920date:2018-07-19T00:00:00
db:JVNDBid:JVNDB-2018-008257date:2018-10-12T00:00:00
db:CNNVDid:CNNVD-201807-1552date:2019-10-23T00:00:00
db:NVDid:CVE-2018-5540date:2024-11-21T04:09:01.897

SOURCES RELEASE DATE
db:VULHUBid:VHN-135571date:2018-07-19T00:00:00
db:BIDid:104920date:2018-07-19T00:00:00
db:JVNDBid:JVNDB-2018-008257date:2018-10-12T00:00:00
db:CNNVDid:CNNVD-201807-1552date:2018-07-19T00:00:00
db:NVDid:CVE-2018-5540date:2018-07-19T14:29:00.730