複数の F5 BIG-IP 製品におけるアクセス制御に関する脆弱性
| Title |
複数の F5 BIG-IP 製品におけるアクセス制御に関する脆弱性
|
| Summary |
複数の F5 BIG-IP 製品には、アクセス制御に関する脆弱性が存在します。
|
| Possible impacts |
サービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
May 1, 2018, midnight |
| Registration Date |
July 2, 2018, 5:07 p.m. |
| Last Update |
July 2, 2018, 5:07 p.m. |
|
CVSS3.0 : 警告
|
| Score |
5.4
|
| Vector |
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H |
|
CVSS2.0 : 注意
|
| Score |
2.3
|
| Vector |
AV:A/AC:M/Au:S/C:N/I:N/A:P |
Affected System
| F5 Networks |
|
BIG-IP Access Policy Manager (APM)
|
|
BIG-IP Advanced Firewall Manager (AFM)
|
|
BIG-IP Analytics
|
|
BIG-IP Application Acceleration Manager (AAM)
|
|
BIG-IP Application Security Manager (ASM)
|
|
BIG-IP Domain Name System (DNS)
|
|
BIG-IP Edge Gateway
|
|
BIG-IP Global Traffic Manager (GTM)
|
|
BIG-IP Link Controller
|
|
BIG-IP Local Traffic Manager (LTM)
|
|
BIG-IP Policy Enforcement Manager (PEM)
|
|
BIG-IP WebAccelerator
|
|
BIG-IP WebSafe
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2018年07月02日]
掲載 |
July 2, 2018, 5:07 p.m. |
NVD Vulnerability Information
CVE-2018-5518
| Summary |
On F5 BIG-IP 13.0.0-13.1.0.5 or 12.0.0-12.1.3.3, malicious root users with access to a VCMP guest can cause a disruption of service on adjacent VCMP guests running on the same host. Exploiting this vulnerability causes the vCMPd process on the adjacent VCMP guest to restart and produce a core file. This issue is only exploitable on a VCMP guest which is operating in "host-only" or "bridged" mode. VCMP guests which are "isolated" are not impacted by this issue and do not provide mechanism to exploit the vulnerability. Guests which are deployed in "Appliance Mode" may be impacted however the exploit is not possible from an Appliance Mode guest. To exploit this vulnerability root access on a guest system deployed as "host-only" or "bridged" mode is required.
|
| Publication Date |
May 2, 2018, 10:29 p.m. |
| Registration Date |
March 1, 2021, 7:31 p.m. |
| Last Update |
Nov. 21, 2024, 1:08 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration2 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration3 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration4 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| Configuration5 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration6 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration7 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| Configuration8 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| Configuration9 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration10 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration11 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| Configuration12 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
| cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| Configuration13 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* |
13.0.0 |
13.1.0 |
|
|
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* |
12.0.0 |
12.1.3 |
|
|
Related information, measures and tools
Common Vulnerabilities List