CVE-2018-5546

{"containers": {"cna": {"affected": [{"product": "BIG-IP APM client for Linux", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "Prior to version 7.1.7.1"}]}, {"product": "BIG-IP APM client for macOS", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "Prior to version 7.1.7.1"}]}], "datePublic": "2018-08-16T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or assume super-user privileges on the local client host."}], "problemTypes": [{"descriptions": [{"description": "Privilege Escalation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-24T16:57:17.000Z", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K54431371"}, {"name": "1041510", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041510"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "f5sirt@f5.com", "DATE_PUBLIC": "2018-08-16T00:00:00", "ID": "CVE-2018-5546", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "BIG-IP APM client for Linux", "version": {"version_data": [{"version_value": "Prior to version 7.1.7.1"}]}}, {"product_name": "BIG-IP APM client for macOS", "version": {"version_data": [{"version_value": "Prior to version 7.1.7.1"}]}}]}, "vendor_name": "F5 Networks, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or assume super-user privileges on the local client host."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Privilege Escalation"}]}]}, "references": {"reference_data": [{"name": "https://support.f5.com/csp/article/K54431371", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K54431371"}, {"name": "1041510", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041510"}, {"name": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt", "refsource": "MISC", "url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:40:50.580Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K54431371"}, {"name": "1041510", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1041510"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt"}]}]}, "cveMetadata": {"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2018-5546", "datePublished": "2018-08-17T13:00:00.000Z", "dateReserved": "2018-01-12T00:00:00.000Z", "dateUpdated": "2024-09-17T02:31:29.055Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "BIG-IP APM client for Linux", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "Prior to version 7.1.7.1"}]}, {"product": "BIG-IP APM client for macOS", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "Prior to version 7.1.7.1"}]}], "source": "f5sirt@f5.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager_client:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA07D5C9-A41B-4BBD-B219-08FDD4931C97", "versionEndIncluding": "7.1.7", "versionStartIncluding": "7.1.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BB42D3A-71EE-4367-9F65-86404D74E59D", "versionEndIncluding": "12.1.3", "versionStartIncluding": "12.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of sensitive information, manipulate certain data, or assume super-user privileges on the local client host."}, {"lang": "es", "value": "Los componentes svpn y policyserver del cliente F5 BIG-IP APM en versiones anteriores a la 7.1.7.1 para Linux y macOS se ejecutan como un proceso privilegiado y pueden permitir que un usuario sin privilegios obtenga la propiedad de archivos propiedad de root en el host del cliente local. Un usuario local no privilegiado malicioso puede adquirir conocimiento de informaci\u00f3n sensible, manipular determinados datos o asumir privilegios de superusuario en el host del cliente local."}], "id": "CVE-2018-5546", "lastModified": "2026-06-17T02:00:30.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-08-17T12:29:00.410", "references": [{"source": "f5sirt@f5.com", "tags": ["Broken Link"], "url": "http://www.securitytracker.com/id/1041510"}, {"source": "f5sirt@f5.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt"}, {"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K54431371"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://www.securitytracker.com/id/1041510"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2018-5529.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K54431371"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}