F5 has determined that a buffer overflow vulnerability exists in FirePass web services that provide User access, which could allow a remote attacker to gain privileged access to the FirePass controller. Web services providing User access can be identified by the U in the Services column on the Device Management: Configuration: Network Configuration page. This issue could result in remote, privileged access on the FirePass, leading to the disclosure of sensitive information, access to restricted resources or other exploits.
F5 Product Development tracked this issue as CR94509 and it was fixed in FirePass version 6.0.2. For information about upgrading, refer to the FirePass release notes.
Additionally, this issue was fixed in a hotfix issued for FirePass version 6.0.1.
Obtaining and installing patches
You can download a hotfix from the F5 Downloads site for the following product and version:
Product | Version | Hotfix | Installation File
FirePass | 6.0.1 | Cumulative HF-601-7 | HF-601-7-6.01-ALL-0.tar.gz.enc
Note: For more information about installing the hotfixes listed above, refer to the readme file on the F5 Downloads site for your version-specific hotfix.
For information about downloading software, refer to SOL167: Downloading software from F5 Networks.
F5 would like to acknowledge Jesse Michael for his efforts in identifying this issue.