PT-2014-8692 · F5 · Big-Ip

Publicado 2014-11-17 · Atualizado 2017-09-08 · CVE-2014-8727

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 10.2.2

Description The issue allows local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the name parameter to specific API endpoints, such as "tmui/Control/jspmap/tmui/system/archive/properties.jsp" or "tmui/Control/form".

Recommendations For versions prior to 10.2.2, update to version 10.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the name parameter in the affected API endpoints until a patch is available. Restrict access to the vulnerable API endpoints "tmui/Control/jspmap/tmui/system/archive/properties.jsp" and "tmui/Control/form" to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-8727

Produtos afetados

Big-Ip

Referências · 9

• 🔥 https://exploit-db.com/exploits/35222 · Exploit
• 🔥 http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html · Exploit
• 🔥 http://exploit-db.com/exploits/35222 · Exploit
• http://securitytracker.com/id/1031216 · Nota
• https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html · Aviso do Fabricante
• http://securityfocus.com/bid/71063 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8727 · Nota de Segurança
• https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98676 · Nota