Vulnerabilities > CVE-2018-15311 - Unspecified vulnerability in F5 products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
f5
nessus
NVD
Published: 2018-10-10
Updated: 2019-10-03

Summary

When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature enabled, TMM may crash, leading to a failover event. This vulnerability is not exposed unless LRO is enabled, so most affected customers will be on 13.1.x. LRO has been available since 11.4.0 but is not enabled by default until 13.1.0.

Vulnerable Configurations

Part Description Count
Application
F5
389

Nessus

NASL familyF5 Networks Local Security Checks
NASL idF5_BIGIP_SOL07550539.NASL
descriptionWhen Large Receive Offload (LRO) is enabled, undisclosed traffic patterns may cause TMM to restart. LRO has been available since 11.4.0 but is not enabled by default until13.1.0 for all platformsand 12.0.0 for Virtual Edition. (CVE-2018-15311) Impact An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group. Note : This vulnerability is not exposed unless Large Receive Offload (LRO) is enabled. For more information about LRO being enabled by default, refer toK33612400: TCP Large Receive Offload tm.tcplargereceiveoffload database variable is enabled by default.
last seen2020-06-01
modified2020-06-02
plugin id118624
published2018-11-02
reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/118624
titleF5 Networks BIG-IP : TMM with LRO vulnerability (K07550539)
code
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from F5 Networks BIG-IP Solution K07550539.
#
# The text description of this plugin is (C) F5 Networks.
#

include("compat.inc");

if (description)
{
  script_id(118624);
  script_version("1.3");
  script_cvs_date("Date: 2019/01/04 10:03:41");

  script_cve_id("CVE-2018-15311");

  script_name(english:"F5 Networks BIG-IP : TMM with LRO vulnerability (K07550539)");
  script_summary(english:"Checks the BIG-IP version.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote device is missing a vendor-supplied security patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"When Large Receive Offload (LRO) is enabled, undisclosed traffic
patterns may cause TMM to restart. LRO has been available since 11.4.0
but is not enabled by default until13.1.0 for all platformsand 12.0.0
for Virtual Edition. (CVE-2018-15311)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system
to fail over to another device in the device group.

Note : This vulnerability is not exposed unless Large Receive Offload
(LRO) is enabled. For more information about LRO being enabled by
default, refer toK33612400: TCP Large Receive Offload
tm.tcplargereceiveoffload database variable is enabled by default."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://support.f5.com/csp/article/K07550539"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade to one of the non-vulnerable versions listed in the F5
Solution K07550539."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_access_policy_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_advanced_firewall_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_acceleration_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_security_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_visibility_and_reporting");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_global_traffic_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_link_controller");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_local_traffic_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_policy_enforcement_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_webaccelerator");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip");

  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/09");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/02");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"F5 Networks Local Security Checks");

  script_dependencies("f5_bigip_detect.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/BIG-IP/hotfix", "Host/BIG-IP/modules", "Host/BIG-IP/version", "Settings/ParanoidReport");

  exit(0);
}


include("f5_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
version = get_kb_item("Host/BIG-IP/version");
if ( ! version ) audit(AUDIT_OS_NOT, "F5 Networks BIG-IP");
if ( isnull(get_kb_item("Host/BIG-IP/hotfix")) ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/hotfix");
if ( ! get_kb_item("Host/BIG-IP/modules") ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/modules");

sol = "K07550539";
vmatrix = make_array();

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# AFM
vmatrix["AFM"] = make_array();
vmatrix["AFM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["AFM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# AM
vmatrix["AM"] = make_array();
vmatrix["AM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["AM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# APM
vmatrix["APM"] = make_array();
vmatrix["APM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["APM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# ASM
vmatrix["ASM"] = make_array();
vmatrix["ASM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["ASM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# AVR
vmatrix["AVR"] = make_array();
vmatrix["AVR"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["AVR"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# GTM
vmatrix["GTM"] = make_array();
vmatrix["GTM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["GTM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# LC
vmatrix["LC"] = make_array();
vmatrix["LC"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["LC"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# LTM
vmatrix["LTM"] = make_array();
vmatrix["LTM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["LTM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# PEM
vmatrix["PEM"] = make_array();
vmatrix["PEM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["PEM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");

# WAM
vmatrix["WAM"] = make_array();
vmatrix["WAM"]["affected"  ] = make_list("13.0.0-13.1.0","12.1.0-12.1.3","11.6.0-11.6.3");
vmatrix["WAM"]["unaffected"] = make_list("13.1.0.6","12.1.3.6","11.6.3.3");


if (bigip_is_affected(vmatrix:vmatrix, sol:sol))
{
  if (report_verbosity > 0) security_warning(port:0, extra:bigip_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = bigip_get_tested_modules();
  audit_extra = "For BIG-IP module(s) " + tested + ",";
  if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);
  else audit(AUDIT_HOST_NOT, "running any of the affected modules");
}

References