K82518062 : BIG-IP SCP vulnerability CVE-2020-5906

Security Advisory Description

The BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP. (CVE-2020-5906)

Note: F5 is working to eliminate exclusionary language in our products and documentation. For more information, refer to K34150231: Exclusionary language in F5 products and documentation.

Impact

Authenticated users with access to the SCP utility, which is an OpenSSH tool, but without full file system or Advanced Shell (bash) access, can read and overwrite certain configuration files that are otherwise restricted through SCP.