CVE-2018-15328 On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication a...
HighCVSS 7.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip access policy manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip access policy manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip access policy manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip access policy manager | = 14.0.0 | No fix listed |
| f5 big-ip advanced firewall manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip advanced firewall manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip advanced firewall manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip advanced firewall manager | = 14.0.0 | No fix listed |
| f5 big-ip analytics | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip analytics | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip analytics | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip analytics | = 14.0.0 | No fix listed |
| f5 big-ip application acceleration manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip application acceleration manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip application acceleration manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip application acceleration manager | = 14.0.0 | No fix listed |
| f5 big-ip application security manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip application security manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip application security manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip application security manager | = 14.0.0 | No fix listed |
| f5 big-ip domain name system | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip domain name system | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip domain name system | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip domain name system | = 14.0.0 | No fix listed |
| f5 big-ip edge gateway | >= 11.2.1, <= 11.6.3 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip edge gateway | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip edge gateway | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip edge gateway | = 14.0.0 | No fix listed |
| f5 big-ip fraud protection service | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip fraud protection service | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip fraud protection service | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip fraud protection service | = 14.0.0 | No fix listed |
| f5 big-ip global traffic manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip global traffic manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip global traffic manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip global traffic manager | = 14.0.0 | No fix listed |
| f5 big-ip link controller | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip link controller | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip link controller | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip link controller | = 14.0.0 | No fix listed |
| f5 big-ip local traffic manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip local traffic manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip local traffic manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip local traffic manager | = 14.0.0 | No fix listed |
| f5 big-ip policy enforcement manager | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip policy enforcement manager | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip policy enforcement manager | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip policy enforcement manager | = 14.0.0 | No fix listed |
| f5 big-ip webaccelerator | >= 11.2.1, <= 11.6.3 | No fix listed |
| f5 big-ip webaccelerator | >= 12.1.0, <= 12.1.3 | No fix listed |
| f5 big-ip webaccelerator | >= 13.0.0, <= 13.1.1 | No fix listed |
| f5 big-ip webaccelerator | = 14.0.0 | No fix listed |
| f5 enterprise manager | = 3.1.1 | No fix listed |
| f5 big-iq centralized management | >= 5.0.0, <= 5.4.0 | No fix listed |
| f5 big-iq centralized management | >= 6.0.0, <= 6.0.1 | No fix listed |
| f5 big-iq centralized management | = 4.6.0 | No fix listed |
| f5 iworkflow | >= 2.2.0, <= 2.3.0 | No fix listed |
| f5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow | = BIG-IP 14.0.x, 13.x, 12.x, 11.x | No fix listed |
| f5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow | = EM 3.1.1 | No fix listed |
| f5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow | = BIG-IQ 6.x, 5.x, 4.x | No fix listed |
| f5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator), Enterprise Manager, BIG-IQ Centralized Management, F5 iWorkflow | = iWorkflow 2.x | No fix listed |
References
- 106258 third-party-advisory vdb-entry
- support.f5.com vendor-advisory