PT-2007-1671 · F5 · F5 Firepass

Published 2007-01-11 · Updated 2008-11-15 · CVE-2007-0187

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F5 FirePass versions 5.4 through 5.5.2 F5 FirePass version 6.0

Description The issue allows remote attackers to access restricted URLs through various methods, including a trailing null byte, multiple leading slashes, Unicode encoding, URL-encoded directory traversal or same-directory characters, or upper case letters in the domain name.

Recommendations For F5 FirePass versions 5.4 through 5.5.2, update to a version that addresses the issue of accessing restricted URLs through special characters and encoding. For F5 FirePass version 6.0, update to a version that addresses the issue of accessing restricted URLs through special characters and encoding. As a temporary workaround, consider restricting access to sensitive URLs to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0187

Affected Products

F5 Firepass

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-0187 · Security Note
• http://mnin.org/advisories/2007_firepass.pdf · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0141.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html · Note
• http://osvdb.org/39167 · Note
• http://securityfocus.com/bid/21957 · Note
• http://secunia.com/advisories/23626 · Note
• https://tech.f5.com/home/solutions/sol6924.html · Note
• http://secunia.com/advisories/23640 · Note
• https://tech.f5.com/home/solutions/sol6916.html · Note