PT-2012-3310 · F5 · F5 Big-Ip+1

Florent Daigniere · Publicado 2012-07-09 · Atualizado 2012-07-10 · CVE-2012-1493

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP appliances versions 9.x through 9.4.8-HF4, versions 10.x through 10.2.4, versions 11.0.x through 11.0.0-HF1, and versions 11.1.x through 11.1.0-HF2 F5 Enterprise Manager versions 2.1.x through 2.1.0-HF1, versions 2.2.x through 2.2.0-HF0, and versions 2.3.x through 2.3.0-HF2

Description The issue arises from the use of a single SSH private key across different customers' installations, combined with a lack of proper access restrictions to this key. This makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Recommendations For F5 BIG-IP appliances versions 9.x through 9.4.8-HF4, update to version 9.4.8-HF5 or later. For F5 BIG-IP appliances versions 10.x through 10.2.4, update to version 10.2.4 or later. For F5 BIG-IP appliances versions 11.0.x through 11.0.0-HF1, update to version 11.0.0-HF2 or later. For F5 BIG-IP appliances versions 11.1.x through 11.1.0-HF2, update to version 11.1.0-HF3 or later. For F5 Enterprise Manager versions 2.1.x through 2.1.0-HF1, update to version 2.1.0-HF2 or later. For F5 Enterprise Manager versions 2.2.x through 2.2.0-HF0, update to version 2.2.0-HF1 or later. For F5 Enterprise Manager versions 2.3.x through 2.3.0-HF2, update to version 2.3.0-HF3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-1493

Produtos afetados

F5 Big-Ip

F5 Enterprise Manager

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19091 · Exploit
• 🔥 https://exploit-db.com/exploits/19099 · Exploit
• 🔥 https://exploit-db.com/exploits/19064 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1493 · Nota de Segurança
• http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html · Aviso do Fabricante
• https://trustmatta.com/advisories/MATTA-2012-002.txt · Nota
• http://theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit · Nota