RSS   Vulnerabilities for 'Firepass'   RSS

2014-12-09
 
CVE-2014-8730

 

 
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.

 
2014-10-15
 
CVE-2014-2927

CWE-287
 

 
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

 
2014-02-10
 
CVE-2013-6024

CWE-200
 

 
The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.x, and FirePass 7.0.0 allow attackers to obtain sensitive information from process memory via unspecified vectors.

 
2013-08-09
 
CVE-2013-0150

 

 
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.

 
2012-04-05
 
CVE-2012-2053

CWE-264
 

 
The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP scripts, a different vulnerability than CVE-2012-1777.

 
 
CVE-2012-1777

CWE-89
 

 
SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.

 
2007-01-12
 
CVE-2007-0195

 

 
my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.

 
 
CVE-2007-0188

 

 
F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.

 
 
CVE-2007-0187

 

 
F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letters in the domain name.

 

 >>> Vendor: F5 60 Products
Big-ip
Icontrol service manager
Firepass 4100
Firepass 1000
Firepass
Firepass ssl vpn
Firepass 1200
Big-ip application security manager
Big-ip protocol security manager
Big-ip local traffic manager
Big-ip global traffic manager
Enterprise manager
Application security manager appliance
Big-ip access policy manager
Big-ip edge gateway
Big-ip link controller
Big-ip protocol security module
Big-ip wan optimization manager
Big-ip webaccelerator
Big-ip configuration utility
Big-ip analytics
Big-iq
Big-ip advanced firewall manager
Big-ip application acceleration manager
Big-ip policy enforcement manager
Arx data manager
ARX
Big-iq cloud
Big-iq device
Big-iq security
Linerate
Big-ip policy enforcement manager11.5.1
Big-iq adc
Big-ip enterprise manager
Big-ip domain name system
Big-ip global traffic manager11.2.0
Big-iq application delivery controller
Big-iq centralized management
Big-iq cloud and orchestration
Big-ip websafe
F5 iworkflow
Ssl intercept iapp
Ssl orchestrator
Big-ip aam
Big-ip afm
Big-ip apm
Big-ip asm
Big-ip ltm
Big-ip pem
Websafe
Big-ip dns
Big-ip fraud protection service
Traffix systems signaling delivery controller
Big-ip access policy manager client
TMOS
Traffix signaling delivery controller
Big-ip webaccelerator12.1.1
Traffix sdc
Websafe alert server
Iworkflow


Copyright 2019, cxsecurity.com

 

Back to Top