F5 Networks BIG-IP : TMM with LRO vulnerability (K07550539)

Medium Nessus Plugin ID 118624

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

When Large Receive Offload (LRO) is enabled, undisclosed traffic
patterns may cause TMM to restart. LRO has been available since 11.4.0
but is not enabled by default until13.1.0 for all platformsand 12.0.0
for Virtual Edition. (CVE-2018-15311)

Impact

An attacker may be able to disrupt traffic or cause the BIG-IP system
to fail over to another device in the device group.

Note : This vulnerability is not exposed unless Large Receive Offload
(LRO) is enabled. For more information about LRO being enabled by
default, refer toK33612400: TCP Large Receive Offload
tm.tcplargereceiveoffload database variable is enabled by default.

Solution

Upgrade to one of the non-vulnerable versions listed in the F5
Solution K07550539.

See Also

https://support.f5.com/csp/article/K07550539

Plugin Details

Severity: Medium

ID: 118624

File Name: f5_bigip_SOL07550539.nasl

Version: 1.3

Type: local

Published: 2018/11/02

Modified: 2019/01/04

Dependencies: 76940

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS v3.0

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip

Patch Publication Date: 2018/10/09

Reference Information

CVE: CVE-2018-15311