Vulnerabilities > CVE-2018-5538 - Unspecified vulnerability in F5 products

CVSS 3.7 - LOW

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

high complexity

nessus

NVD

Published: 2018-07-25

Updated: 2019-10-03

Summary

On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable "dnsexpress.notifyport" is set to any value other than the default of "0".

Vulnerable Configurations

Part	Description	Count
Application	F5 F5 BIG IP Domain Name System 13.1.0.0 F5 BIG IP Domain Name System 13.1.0.1 F5 BIG IP Domain Name System 13.1.0.2 F5 BIG IP Domain Name System 13.1.0.3 F5 BIG IP Domain Name System 13.1.0.4 F5 BIG IP Domain Name System 13.1.0.5 F5 BIG IP Domain Name System 13.1.0.6 F5 BIG IP Domain Name System 13.1.0.7 F5 BIG IP Domain Name System 12.1.3 F5 BIG IP Domain Name System 12.1.3.1 F5 BIG IP Domain Name System 12.1.3.2 F5 BIG IP Domain Name System 12.1.3.3 F5 BIG IP Domain Name System 12.1.3.4 F5 BIG IP Domain Name System 12.1.3.5 F5 BIG IP Global Traffic Manager 13.1.0 F5 BIG IP Global Traffic Manager 13.1.0.0 F5 BIG IP Global Traffic Manager 13.1.0.1 F5 BIG IP Global Traffic Manager 13.1.0.2 F5 BIG IP Global Traffic Manager 13.1.0.3 F5 BIG IP Global Traffic Manager 13.1.0.4 F5 BIG IP Global Traffic Manager 13.1.0.5 F5 BIG IP Global Traffic Manager 13.1.0.6 F5 BIG IP Global Traffic Manager 13.1.0.7 F5 BIG IP Global Traffic Manager 12.1.3 F5 BIG IP Global Traffic Manager 12.1.3.1 F5 BIG IP Global Traffic Manager 12.1.3.2 F5 BIG IP Global Traffic Manager 12.1.3.3 F5 BIG IP Global Traffic Manager 12.1.3.4 F5 BIG IP Global Traffic Manager 12.1.3.5 F5 BIG IP Local Traffic Manager 13.1.0 F5 BIG IP Local Traffic Manager 13.1.0.0 F5 BIG IP Local Traffic Manager 13.1.0.1 F5 BIG IP Local Traffic Manager 13.1.0.2 F5 BIG IP Local Traffic Manager 13.1.0.3 F5 BIG IP Local Traffic Manager 13.1.0.4 F5 BIG IP Local Traffic Manager 13.1.0.5 F5 BIG IP Local Traffic Manager 13.1.0.6 F5 BIG IP Local Traffic Manager 13.1.0.7 F5 BIG IP Local Traffic Manager 12.1.3 F5 BIG IP Local Traffic Manager 12.1.3.1 F5 BIG IP Local Traffic Manager 12.1.3.2 F5 BIG IP Local Traffic Manager 12.1.3.3 F5 BIG IP Local Traffic Manager 12.1.3.4 F5 BIG IP Local Traffic Manager 12.1.3.5 F5 BIG IP Link Controller 13.1.0 F5 BIG IP Link Controller 13.1.0.0 F5 BIG IP Link Controller 13.1.0.1 F5 BIG IP Link Controller 13.1.0.2 F5 BIG IP Link Controller 13.1.0.3 F5 BIG IP Link Controller 13.1.0.4 F5 BIG IP Link Controller 13.1.0.5 F5 BIG IP Link Controller 13.1.0.6 F5 BIG IP Link Controller 13.1.0.7 F5 BIG IP Link Controller 12.1.3 F5 BIG IP Link Controller 12.1.3.1 F5 BIG IP Link Controller 12.1.3.2 F5 BIG IP Link Controller 12.1.3.3 F5 BIG IP Link Controller 12.1.3.4 F5 BIG IP Link Controller 12.1.3.5	59

Nessus

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL45435121.NASL
description	On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the
last seen	2020-06-01
modified	2020-06-02
plugin id	118666
published	2018-11-02
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118666
title	F5 Networks BIG-IP : DNS Express vulnerability (K45435121)

References

https://support.f5.com/csp/article/K45435121