F5 Networks BIG-IP : TMM vulnerability (K34514540)

Medium Nessus Plugin ID 118604

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

Malicious requests made to virtual servers with an HTTP profile can
cause the TMM to restart. The issue is exposed with BIG-IP APM
profiles, regardless of settings. The issue is also exposed with the
non-default 'normalize URI' configuration options used in iRules
and/or BIG-IP LTM policies. (CVE-2017-6138)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system
to fail over to another device in the device group. This vulnerability
affects systems with any of the following configurations :

A virtual server associated with a BIG-IPAPM profile.

A virtual server associated with an HTTP profile and a local traffic
policy that has a rule condition with the HTTP URI and Use normalized
URI options enabled (the Use normalized URI option is disabled by
default). For example, in the following configuration excerpt, the
local traffic policy is vulnerable :

ltm policy /Common/K34514540 {

requires { http } rules { vulnerable { conditions { 0 { http-uri path
normalized values { /exploitable } } } } } strategy
/Common/first-match }

A virtual server associated with an HTTP profile and an iRule using
any of the following iRules commands with the -normalized switch:
HTTP::uri

HTTP::query

HTTP::path

For example :

when HTTP_REQUEST { if { ([HTTP::uri -normalized] starts_with
'/exploitable')} { log local0.error 'K34514540 URI example' } elseif {
([HTTP::query -normalized] starts_with '/exploitable')} { log
local0.error 'K34514540 Query example' } elseif { ([HTTP::path

-normalized] starts_with '/exploitable')} { log local0.error
'K34514540 Path example' } }

Solution

Upgrade to one of the non-vulnerable versions listed in the F5
Solution K34514540.

See Also

https://support.f5.com/csp/article/K34514540

Plugin Details

Severity: Medium

ID: 118604

File Name: f5_bigip_SOL34514540.nasl

Version: 1.2

Type: local

Published: 2018/11/02

Modified: 2019/01/04

Dependencies: 76940

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/h:f5:big-ip

Patch Publication Date: 2017/12/20

Reference Information

CVE: CVE-2017-6138