Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2383.4
K52320548: Expat vulnerability CVE-2016-0718
26 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: F5 Products
Publisher: F5 Networks
Operating System: Network Appliance
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-0718
Reference: ESB-2016.2815
Original Bulletin:
https://support.f5.com/csp/article/K52320548
Revision History: July 26 2018: Updated security advisory status table.
June 19 2018: Updated security advisory status table.
April 4 2018: Updated "Security Advisory Status" section
September 21 2017: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
K52320548: Expat vulnerability CVE-2016-0718
Security Advisory
Original Publication Date: Sep 19, 2017
Updated Date: Jul 24, 2018
Security Advisory Description
An out-of-bounds read flaw was found in the way Expat processed certain input.
A remote attacker could send specially crafted XML that, when parsed by an
application using the Expat library, would cause that application to crash or,
possibly, execute arbitrary code with the permission of the user running the
application. (CVE-2016-0718)
Impact
A remote attacker could send specially crafted XML which, when parsed by an
application using the Expat library, would cause that application to stop
responding or possibly run arbitrary code with the permission of the user
running the application.
BIG-IP ASM control plane
An authenticated user with the relevant privileges, such as Web Application
Security Editor, can exploit the vulnerability and gain full control of the
system.
big3d/gtmd
The big3d/gtmd processes may be exposed to this vulnerability over the
management port and self IP addresses when the Port Lockdown setting is set to
Default, All, or Custom with TCP port 4353 included. The impact for the big3d
process is a temporary disruption in the communication between peer systems
until the system automatically restarts the big3d process.
Security Advisory Status
F5 Product Development has assigned IDs 630446 and 674189 (BIG-IP) and ID
677266 (Enterprise Manager) to this vulnerability. Additionally, BIG-IP iHealth
may list Heuristic H52320548 on the Diagnostics > Identified > High page.
To determine if your release is known to be vulnerable, the components or
features that are affected by the vulnerability, and for information about
releases or hotfixes that address the vulnerability, refer to the following
table.
+--------------+--------------+----------------+----------+-------------------+
| |Versions known|Versions known | |Vulnerable |
|Product |to be |to be not |Severity |component or |
| |vulnerable |vulnerable | |feature |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | | |
|BIG-IP LTM |11.6.0 - |12.1.3.2 |High |iControl SOAP, |
| |11.6.3 |11.6.3.2 | |eventd |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
| |11.2.1 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | |iControl SOAP, |
|BIG-IP AAM |11.6.0 - |12.1.3.2 |High |eventd |
| |11.6.3 |11.6.3.2 | | |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | |iControl SOAP, |
|BIG-IP AFM |11.6.0 - |12.1.3.2 |High |eventd |
| |11.6.3 |11.6.3.2 | | |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - | | | |
| |12.1.3 |13.1.0 | | |
|BIG-IP |11.6.0 - |13.0.1 |High |iControl SOAP, |
|Analytics |11.6.3 |12.1.3.2 | |eventd |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
| |11.2.1 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | | |
|BIG-IP APM |11.6.0 - |12.1.3.2 |High |iControl SOAP, |
| |11.6.3 |11.6.3.2 | |eventd |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
| |11.2.1 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | |ASM control plane, |
|BIG-IP ASM |11.6.0 - |12.1.3.2 |High |iControl SOAP, |
| |11.6.3 |11.6.3.2 | |eventd |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
| |11.2.1 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 |13.1.0 | |big3d, gtmd, |
|BIG-IP DNS |12.0.0 - |13.0.1 |High |iControl SOAP, |
| |12.1.3 |12.1.3.2 | |eventd |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IP Edge |11.2.1 |None |High |iControl SOAP, |
|Gateway | | | |eventd |
+--------------+--------------+----------------+----------+-------------------+
| |11.6.0 - | | | |
| |11.6.3 |11.6.3.2 | |big3d, gtmd, |
|BIG-IP GTM |11.4.1 - |11.5.7 |High |iControl SOAP, |
| |11.5.6 | | |eventd |
| |11.2.1 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | |big3d, gtmd, |
|BIG-IP Link |11.6.0 - |12.1.3.2 |High |iControl SOAP, |
|Controller |11.6.3 |11.6.3.2 | |eventd |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
| |11.2.1 | | | |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 | | | |
| |12.0.0 - |13.1.0 | | |
| |12.1.3 |13.0.1 | |iControl SOAP, |
|BIG-IP PEM |11.6.0 - |12.1.3.2 |High |eventd |
| |11.6.3 |11.6.3.2 | | |
| |11.4.1 - |11.5.7 | | |
| |11.5.6 | | | |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IP PSM |11.4.1 |None |High |iControl SOAP, |
| | | | |eventd |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IP |11.2.1 |None |High |iControl SOAP, |
|WebAccelerator| | | |eventd |
+--------------+--------------+----------------+----------+-------------------+
| |13.0.0 |13.1.0 | | |
| |12.0.0 - |13.0.1 | |iControl SOAP, |
|BIG-IP WebSafe|12.1.3 |12.1.3.2 |High |eventd |
| |11.6.0 - |11.6.3.2 | | |
| |11.6.3 |11.5.7 | | |
+--------------+--------------+----------------+----------+-------------------+
|ARX |None |6.2.0 - 6.4.0 |Not |None |
| | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|Enterprise |3.1.1 |None |Medium |iControlPortal.cgi |
|Manager | | | | |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IQ Cloud |None |4.4.0 - 4.5.0 |Not |None |
| | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IQ Device |None |4.4.0 - 4.5.0 |Not |None |
| | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IQ |None |4.4.0 - 4.5.0 |Not |None |
|Security | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IQ ADC |None |4.5.0 |Not |None |
| | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IQ | |5.0.0 - 5.3.0 |Not | |
|Centralized |None |4.6.0 |vulnerable|None |
|Management | | | | |
+--------------+--------------+----------------+----------+-------------------+
|BIG-IQ Cloud | | |Not | |
|and |None |1.0.0 |vulnerable|None |
|Orchestration | | | | |
+--------------+--------------+----------------+----------+-------------------+
|F5 iWorkflow |None |2.0.0 - 2.3.0 |Not |None |
| | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|LineRate |None |2.5.0 - 2.6.2 |Not |None |
| | | |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
|Traffix SDC |None |5.0.0 - 5.1.0 |Not |None |
| | |4.0.0 - 4.4.0 |vulnerable| |
+--------------+--------------+----------------+----------+-------------------+
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by upgrading to a version listed
in the Versions known to be not vulnerable column. If the table lists only an
older version than what you are currently running, or does not list a
non-vulnerable version, then no upgrade candidate currently exists.
Mitigation
iControl SOAP, eventd and BIG-IP ASM control plane
To mitigate this vulnerability for iControl SOAP, the eventd process, and the
BIG-IP ASM control plane, permit management access to F5 products only over a
secure network and restrict command line access for affected systems to trusted
users. For more information, refer to K13309: Restricting access to the
Configuration utility by source IP address (11.x - 13.x) and K13092: Overview
of securing access to the BIG-IP system.
big3d/gtmd
To mitigate this vulnerability for the big3d/gtmd process, limit connections to
port 4353 to trusted hosts. For more information, refer to K13309: Restricting
access to the Configuration utility by source IP address (11.x - 13.x).
Note: If you run big3d_install on BIG-IP versions prior to 11.5.0, it is
possible that you may install a vulnerable version of big3d on systems that are
running non-vulnerable versions of the BIG-IP system. In this case, upgrade to
a fixed version or hotfix, and refer to K13312: Overview of the BIG-IP DNS
big3d_install, bigip_add, and gtm_add utilities (11.x - 13.x) for information
about running big3d_install to resolve the issue.
Note: The iquery protocol used by the BIG-IP DNS system (formerly BIG-IP GTM)
also uses port 4353. Ensure that all of the peer devices are included when you
limit connections by IP address.
Supplemental Information
o K17329: BIG-IP GTM name has changed to BIG-IP DNS
o K9970: Subscribing to email notifications regarding F5 products
o K9957: Creating a custom RSS feed to view new and updated documents
o K4602: Overview of the F5 security vulnerability response policy
o K4918: Overview of the F5 critical issue hotfix policy
o K167: Downloading software and firmware from F5
o K9502: BIG-IP hotfix and point release matrix
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW1lQo2aOgq3Tt24GAQhSShAA25l8WqMU4gpI0RYuaNXDMSNpqWl8p2aA
AAlqlQ29OKa0cYdStS+Xux8EEDPxCHwrHfFI4gZTVwSuy2qnBK1XS8qx+PQEy8Mz
PCEKgdFg840MdIEwfbr9fCb4snAlwA+q1sCDaQ9ODzL/ZpUYcrPRglm4aC0zGE5i
87aMW+yPhxoRrfnml7OUKa7AuKJTsLLasYb7ker5WdkSH7G6bAsnSXtolXm51IyA
BOuwzxPTRQupPhGq3BDpxVunjmt8nHNFC1TeUVetBC1yHRut0KARv+Xcd8uldRcU
t2ZTbFSJOiMm+J2XXS3gQI7Wr1lWhH5q+Rf/KtyPOfFhVzx6FsAZvXX826HSiss4
OZlHqHWj8WIbedUzYXJjMXTlN6UV1rQUVo4GweDQxd5v76KS/w+zI+YPqJgWJKDd
jH3wiVwzLXZrYyH/OFcCxLQZ4cBZhKikgT09QidqvkMTGCEWK5tIVkX7sXcYTVJA
JzA6JeUM/Ob0H1MaKlP6qE7ouDn8rZZTX1Axy972GJ4pY6a5ywSOKvQgqArJm7cH
gRRECrMf9GT5EpzIf8tQ5sdjE4I5UOgfRksB9h4tuchp0NgcH4L4Av5GhSuJL7Kf
0mfsYBE8mN1wEnWHufUrjjMInA0/SN7DsrmJT+B8H1S8qxbdZ6BMpzhuq8NwZXuM
OzluhrAVOEM=
=6Gz4
-----END PGP SIGNATURE-----