CVE-2020-5929 : Exploit Details and Defense Strategies

This CVE involves vulnerabilities in BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, affecting specific versions.

Understanding CVE-2020-5929

What is CVE-2020-5929?

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with certain configurations may be vulnerable to crafted SSL/TLS Handshakes, potentially leading to plaintext message recovery.

The Impact of CVE-2020-5929

The vulnerability could allow malicious actors to exploit SSL/TLS Handshakes, potentially recovering plaintext messages due to specific error messages acting as an oracle.

Technical Details of CVE-2020-5929

Vulnerability Description

Vulnerability in BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards
Virtual Server configured with a Client SSL profile
Use of Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange
Single DH use option not enabled

Affected Systems and Versions

BIG-IP versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, 11.6.1-11.6.2

Exploitation Mechanism

Crafted SSL/TLS Handshakes may result in a PMS starting with a 0 byte
Error messages in BIG-IP TLS/SSL ADH/DHE can act as an oracle
Precise timing measurement observation can expose the vulnerability

Mitigation and Prevention

Immediate Steps to Take

Apply the necessary patches provided by the vendor
Disable Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange
Enable the Single DH use option in the options list

Long-Term Security Practices

Regularly update and patch BIG-IP platforms
Implement secure SSL/TLS configurations

Patching and Updates

Check for updates and patches from the vendor
Apply security updates promptly to mitigate the vulnerability