CVE-2018-5538 : Security Advisory and Response
Learn about CVE-2018-5538 affecting F5 Networks, Inc.'s BIG-IP DNS versions 13.1.0-13.1.0.7 and 12.1.3-12.1.3.5. Discover the impact, technical details, and mitigation steps for this vulnerability.
F5 Networks, Inc.'s BIG-IP DNS versions 13.1.0-13.1.0.7 and 12.1.3-12.1.3.5 are susceptible to a vulnerability that allows DNS Express and DNS Zones to accept NOTIFY messages from unauthorized source IP addresses.
Understanding CVE-2018-5538
This CVE involves a vulnerability in F5 BIG-IP DNS versions 13.1.0-13.1.0.7 and 12.1.3-12.1.3.5 that enables unauthorized source IP addresses to send NOTIFY messages to DNS Express and DNS Zones.
What is CVE-2018-5538?
The vulnerability in F5 BIG-IP DNS versions 13.1.0-13.1.0.7 and 12.1.3-12.1.3.5 allows for the acceptance of NOTIFY messages from source IP addresses not specified in the 'Allow NOTIFY From' configuration parameter.
The Impact of CVE-2018-5538
This vulnerability could be exploited by attackers to send unauthorized NOTIFY messages to DNS Express and DNS Zones, potentially leading to a Denial of Service (DoS) condition.
Technical Details of CVE-2018-5538
F5 Networks, Inc.'s BIG-IP DNS versions 13.1.0-13.1.0.7 and 12.1.3-12.1.3.5 are affected by the following technical details:
Vulnerability Description
The vulnerability allows DNS Express and DNS Zones to accept NOTIFY messages from source IP addresses not specified in the 'Allow NOTIFY From' configuration parameter.
Affected Systems and Versions
- Product: BIG-IP (DNS)
- Versions: 13.1.0-13.1.0.7, 12.1.3-12.1.3.5
Exploitation Mechanism
The issue arises when the "dnsexpress.notifyport" variable in the management interface is set to a value other than the default of "0".
Mitigation and Prevention
To address CVE-2018-5538, consider the following mitigation and prevention strategies:
Immediate Steps to Take
- Update the affected F5 BIG-IP DNS versions to patched releases.
- Review and restrict the 'Allow NOTIFY From' configuration parameter.
Long-Term Security Practices
- Regularly monitor and audit DNS configurations for unauthorized changes.
- Implement network segmentation to limit the impact of potential DNS vulnerabilities.
Patching and Updates
- Apply patches provided by F5 Networks, Inc. to address the vulnerability in affected versions.