PT-2007-1672 · F5 · F5 Firepass

Published 2007-01-11 · Updated 2008-09-05 · CVE-2007-0188

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F5 FirePass versions 5.4 through 5.5.1

Description The issue arises from the improper enforcement of host access restrictions when a client uses a single integer representation of an IP address, also known as a "dotless IP address". This allows remote authenticated users to connect to the administrator console and certain other network resources.

Recommendations For F5 FirePass versions 5.4 through 5.5.1, consider restricting access to the administrator console and other sensitive network resources until a proper fix is applied. As a temporary workaround, restrict the use of dotless IP addresses to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0188

Affected Products

F5 Firepass

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0188 · Security Note
• http://mnin.org/advisories/2007_firepass.pdf · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html · Note
• https://tech.f5.com/home/solutions/sol6922.html · Note
• http://osvdb.org/32734 · Note
• http://securityfocus.com/bid/21957 · Note
• http://secunia.com/advisories/23640 · Note