CVE-2020-5926 Memory corruption in BIG-IP

High 7.5 Published 26 Aug 2020 Updated 4 Aug 2024

Attackers can cause a denial of service in BIG-IP by sending crafted SIP messages with specific MIME boundaries to a virtual server configured with a SIP ALG profile.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-5926?

CVE-2020-5926 is a high-severity memory corruption vulnerability in F5 Big-Ip Access Policy Manager, published on 26 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache.

Weakness: CWE-404

Which versions are affected by CVE-2020-5926?

It affects 11 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 5 more.

How do I fix CVE-2020-5926?

No fix has been published for CVE-2020-5926 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-5926 being exploited?

There is no known exploitation of CVE-2020-5926 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-8534-5wx9-rc44.