Sign-up

ID

VAR-201810-0901


CVE

CVE-2018-15323


TITLE

plural F5 BIG-IP Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-011696

DESCRIPTION

On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action. plural F5 BIG-IP The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Multiple F5 BIG-IP Products are prone to a denial-of-service vulnerability. Exploiting this issue allows remote attackers to cause a denial-of-service condition due to excessive memory consumption. F5 BIG-IP is an all-in-one network device integrated with network traffic management, application security management, load balancing and other functions from F5 Corporation of the United States. Attackers can use this vulnerability to cause the BIG-IP system to temporarily fail to process traffic and may cause the device to fail over, resulting in a denial of service

Trust: 1.98

sources: NVD: CVE-2018-15323 // JVNDB: JVNDB-2018-011696 // BID: 106562 // VULHUB: VHN-125571

AFFECTED PRODUCTS

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip protocol security modulescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:14.0.0.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip protocol security modulescope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.0

Trust: 0.6

vendor:f5model:big-ip link controllerscope:eqversion:14.0.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:14.0.0

Trust: 0.6

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.0.0

Trust: 0.6

vendor:f5model:big-ip policy enforcement managerscope:eqversion:14.0.0

Trust: 0.6

vendor:f5model:big-ip websafescope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip websafescope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip websafescope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip psmscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip psmscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip psmscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip fpsscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip fpsscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip fpsscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:14.0

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:13.1.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:13.0

Trust: 0.3

vendor:f5model:big-ip websafescope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip websafescope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip websafescope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip psmscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip psmscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip psmscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip fpsscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip fpsscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip fpsscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:13.1.1.2

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:14.1

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:14.0.0.3

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:13.1.1.2

Trust: 0.3

sources: BID: 106562 // JVNDB: JVNDB-2018-011696 // CNNVD: CNNVD-201810-1542 // NVD: CVE-2018-15323

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15323
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-15323
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201810-1542
value: MEDIUM

Trust: 0.6

VULHUB: VHN-125571
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-15323
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125571
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15323
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125571 // JVNDB: JVNDB-2018-011696 // CNNVD: CNNVD-201810-1542 // NVD: CVE-2018-15323

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-125571 // JVNDB: JVNDB-2018-011696 // NVD: CVE-2018-15323

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1542

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201810-1542

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-011696

PATCH
title:K26583415url:https://support.f5.com/csp/article/K26583415
Trust: 0.8
title:F5 BIG-IP Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86517
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-011696 // 
            
            
            
            CNNVD: CNNVD-201810-1542

EXTERNAL IDS
db:NVDid:CVE-2018-15323
Trust: 2.8
db:JVNDBid:JVNDB-2018-011696
Trust: 0.8
db:CNNVDid:CNNVD-201810-1542
Trust: 0.7
db:BIDid:106562
Trust: 0.3
db:VULHUBid:VHN-125571
Trust: 0.1
sources:
            
            
            VULHUB: VHN-125571 // 
            
            
            
            BID: 106562 // 
            
            
            
            JVNDB: JVNDB-2018-011696 // 
            
            
            
            CNNVD: CNNVD-201810-1542 // 
            
            
            
            NVD: CVE-2018-15323

REFERENCES
url:https://support.f5.com/csp/article/k26583415
Trust: 2.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15323
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-15323
Trust: 0.8
url:http://www.f5.com/products/big-ip/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-125571 // 
            
            
            
            BID: 106562 // 
            
            
            
            JVNDB: JVNDB-2018-011696 // 
            
            
            
            CNNVD: CNNVD-201810-1542 // 
            
            
            
            NVD: CVE-2018-15323

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 106562

SOURCES
db:VULHUBid:VHN-125571
db:BIDid:106562
db:JVNDBid:JVNDB-2018-011696
db:CNNVDid:CNNVD-201810-1542
db:NVDid:CVE-2018-15323

LAST UPDATE DATE
2024-11-23T22:55:43.128000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-125571date:2018-12-11T00:00:00
db:BIDid:106562date:2018-10-31T00:00:00
db:JVNDBid:JVNDB-2018-011696date:2019-01-18T00:00:00
db:CNNVDid:CNNVD-201810-1542date:2018-11-01T00:00:00
db:NVDid:CVE-2018-15323date:2024-11-21T03:50:33.717

SOURCES RELEASE DATE
db:VULHUBid:VHN-125571date:2018-10-31T00:00:00
db:BIDid:106562date:2018-10-31T00:00:00
db:JVNDBid:JVNDB-2018-011696date:2019-01-18T00:00:00
db:CNNVDid:CNNVD-201810-1542date:2018-11-01T00:00:00
db:NVDid:CVE-2018-15323date:2018-10-31T14:29:00.580