CVE-2018-5508 : Security Advisory and Response

F5 Networks, Inc. reported a vulnerability affecting BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, and 11.2.1, potentially leading to a denial of service (DoS) due to crashes in Traffic Management Microkernel (TMM) under specific conditions.

Understanding CVE-2018-5508

This CVE involves a vulnerability in F5 BIG-IP PEM versions that could result in TMM crashes when handling compressed data through a Virtual Server with a linked PEM profile and enabled content insertion.

What is CVE-2018-5508?

TMM may crash in specific situations on affected BIG-IP PEM versions while processing compressed data through a Virtual Server with certain configurations.

The Impact of CVE-2018-5508

The vulnerability could lead to a DoS condition, impacting the availability of services relying on the affected versions of BIG-IP PEM.

Technical Details of CVE-2018-5508

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

TMM crashes can occur when handling compressed data through a Virtual Server with a linked PEM profile and enabled content insertion on specified BIG-IP PEM versions.

Affected Systems and Versions

BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, and 11.2.1 are affected by this vulnerability.

Exploitation Mechanism

The vulnerability is triggered when a Virtual Server with a PEM profile and content insertion option enabled processes compressed data.

Mitigation and Prevention

To address CVE-2018-5508, follow these mitigation strategies:

Immediate Steps to Take

Disable the content insertion option on Virtual Servers with linked PEM profiles.
Monitor F5 Networks for security advisories and updates.

Long-Term Security Practices

Regularly update and patch F5 BIG-IP PEM to the latest versions.
Implement network segmentation and access controls to limit exposure to potential attacks.

Patching and Updates

Apply patches provided by F5 Networks to fix the vulnerability and prevent potential DoS incidents.