exploit the possibilities

F5 BIG-IP Remote Root Authentication Bypass

F5 BIG-IP Remote Root Authentication Bypass
Posted Jun 12, 2012
Authored by Florent Daigniere | Site trustmatta.com

F5 BIG-IP suffers from a remote root authentication bypass vulnerability. Version 11.1.0 build 1943.0 is affected.

tags | exploit, remote, root, bypass
advisories | CVE-2012-1493
MD5 | f140dee508e4c94c041f8c1f92cf87cf

F5 BIG-IP Remote Root Authentication Bypass

Change Mirror Download
  Matta Consulting - Matta Advisory
https://www.trustmatta.com

F5 BIG-IP remote root authentication bypass Vulnerability

Advisory ID: MATTA-2012-002
CVE reference: CVE-2012-1493
Affected platforms: BIG-IP platforms without SCCP
Version: 11.x 10.x 9.x
Date: 2012-February-16
Security risk: High
Vulnerability: F5 BIG-IP remote root authentication bypass
Researcher: Florent Daigniere
Vendor Status: Notified / Patch available
Vulnerability Disclosure Policy:
https://www.trustmatta.com/advisories/matta-disclosure-policy-01.txt
Permanent URL:
https://www.trustmatta.com/advisories/MATTA-2012-002.txt

=====================================================================
Description:

Vulnerable BIG-IP installations allow unauthenticated users to bypass
authentication and login as the 'root' user on the device.

The SSH private key corresponding to the following public key is
public and present on all vulnerable appliances:

ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJT+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbKv58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk= SCCP Superuser

Its fingerprint is:
71:3a:b0:18:e2:6c:41:18:4e:56:1e:fd:d2:49:97:66

=====================================================================
Impact

If successful, a malicious third party can get full control of the
device with little to no effort. The Attacker might reposition and
launch an attack against other parts of the target infrastructure
from there.

=====================================================================
Versions affected:

BIG-IP version 11.1.0 build 1943.0 tested.

The vendor reports that the following versions are patched:
9.4.8-HF5 and later
10.2.4 and later
11.0.0-HF2 and later
11.1.0-HF3 and later

http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html

=====================================================================
Credits

This vulnerability was discovered and researched by Florent Daigniere
from Matta Consulting.

=====================================================================
History

16-02-12 initial discovery
22-02-12 initial attempt to contact the vendor
24-02-12 reply from David Wang, case C1062228 is open
24-02-12 draft of the advisory sent to the vendor
01-03-12 CVE-2012-1493 is assigned
06-04-12 James Affeld starts coordinating the notification effort
23-05-12 F5 notifies us that patches are ready
29-05-12 F5 sends advance notification to some customers
06-06-12 Public disclosure

=====================================================================
About Matta

Matta is a privately held company with Headquarters in London, and a
European office in Amsterdam. Established in 2001, Matta operates
in Europe, Asia, the Middle East and North America using a respected
team of senior consultants. Matta is an accredited provider of
Tiger Scheme training; conducts regular research and is the developer
behind the webcheck application scanner, and colossus network scanner.

https://www.trustmatta.com
https://www.trustmatta.com/training.html
https://www.trustmatta.com/webapp_va.html
https://www.trustmatta.com/network_va.html

=====================================================================
Disclaimer and Copyright

Copyright (c) 2012 Matta Consulting Limited. All rights reserved.
This advisory may be distributed as long as its distribution is
free-of-charge and proper credit is given.

The information provided in this advisory is provided "as is" without
warranty of any kind. Matta Consulting disclaims all warranties, either
express or implied, including the warranties of merchantability and
fitness for a particular purpose. In no event shall Matta Consulting or
its suppliers be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or
special damages, even if Matta Consulting or its suppliers have been
advised of the possibility of such damages.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close