PT-2015-6646 · F5 · F5 Big-Iq Cloud+3

Publicado 2015-07-16 · Atualizado 2015-07-21 · CVE-2015-4637

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IQ Cloud, Device, and Security versions 4.4.0 through 4.5.0 before HF2 F5 BIG-IQ ADC versions 4.5.0 before HF2

Description The issue concerns the REST API when configured for LDAP remote authentication. If the LDAP server allows anonymous BIND operations, remote attackers can obtain an authentication token for arbitrary users by guessing an LDAP user account name.

Recommendations For F5 BIG-IQ Cloud, Device, and Security versions 4.4.0 through 4.5.0 before HF2, apply HF2 to resolve the issue. For F5 BIG-IQ ADC versions 4.5.0 before HF2, apply HF2 to resolve the issue. As a temporary workaround, consider restricting anonymous BIND operations on the LDAP server until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-17

CWE-310

Identificadores relacionados

CVE-2015-4637

Produtos afetados

F5 Big-Iq Adc

F5 Big-Iq Cloud

F5 Big-Iq Device

F5 Big-Iq Security

Referências · 2

• https://support.f5.com/kb/en-us/solutions/public/16000/800/sol16861.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-4637 · Nota de Segurança