CVE-2008-3149

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

Design/Logic Flaw

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

CVE-2008-3149

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

CVE-2008-3149

The CVE-2008-3149 entry affects the SNMP daemon in F5 FirePass 1200 (version 6.0.2 hotfix 3). The vulnerability arises from handling the HOST-RESOURCES-MIB hrSWInstalled OID branch, enabling remote attackers to cause a denial-of-service (daemon crash). Exploitation details, impacted versions beyo...

F5 FirePass 1200 SNMP daemon DoS

F5 FirePass 1200 SNMP daemon DoS Product: F5 FirePass 1200 http://www.f5.com/products/firepass/ The F5 FirePass 1200 SSL VPN appliance contains a denial-of-service vulnerability in the SNMP daemon. Traversing walking OID branch hrSWInstalled in HOST-RESOURCES-MIB OID 1.3.6.1.2.1.25.6 will cause t...

F5 FirePass SNMP DoS

Crash on 1.3.6.1.2.1.25.6 traversing...

F5 FirePass SSL VPN SNMP守护程序远程拒绝服务漏洞

BUGTRAQ ID: 30090 CNCAN ID：CNCAN-2008070810 F5 FirePass SSL VPN设备允许用户安全的连接到关键业务应用设备上。 F5 FirePass 1200 SSL VPN应用设备包含的SNMP守护程序存在拒绝服务问题，远程攻击者可以利用漏洞使应用程序崩溃。 遍历HOST-RESOURCES-MIB OID 1.3.6.1.2.1.25.6中的hrSWInstalled OID分支可导致SNMP守护程序崩溃，目前不清楚是否可利用执行任意代码。 F5 FirePass 6.0.2.3 F5 FirePass 1200 目前没有解决方案提供：...

F5 FirePass SSL VPN多个跨站请求伪造漏洞

BUGTRAQ ID: 29574 CNCAN ID:CNCAN-2008061002 F5 FirePass SSL VPN是一款VPN实现。 F5 FirePass SSL VPN WEB接口不正确过滤用户提供的输入，远程攻击者可以利用漏洞进行跨站请求伪造攻击。 问题存在于/vdesk/admincon/webyfiers.php对cssexceptions参数的过滤及/vdesk/admincon/index.php对sqlmatchscope参数的过滤，由于不正确处理引号，允许攻击者注入恶意代码。 F5 FirePass 6.0.2.3 目前没有解决方案提供：...

CVE-2008-2637

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

CVE-2008-2637

In CVE-2008-2637, the affected product is F5 FirePass SSL VPN 6.0.2 hotfix 3 (and possibly earlier). The vulnerability is multiple cross-site scripting (XSS) flaws in two parameters: css_exceptions (vdesk/admincon/webyfiers.php) and sql_matchscope (vdesk/admincon/index.php), allowing remote attac...

CVE-2008-2637

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

F5 FirePass Content Inspection Management XSS

F5 FirePass Content Inspection Management XSS Product: F5 FirePass http://www.f5.com/products/firepass/ The F5 FirePass SSL VPN appliance provides rudimentary web request sanitization for resources exposed through the appliance via Portal Access. This Content Inspection feature can be configured...

F5 Firepass crossite scripting

Crossite scripting via crossite scripting protection management page...

F5 FirePass 6.0.2.3 - '/vdesk/admincon/index.php?sql_matchscope' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of...

f5firepass-xss.txt

F5 FirePass Content Inspection Management XSS Product: F5 FirePass http://www.f5.com/products/firepass/ The F5 FirePass SSL VPN appliance provides rudimentary web request sanitization for resources exposed through the appliance via Portal Access. This Content Inspection feature can be configured...

F5 FirePass 6.0.2.3 - vdeskadminconindex.php?sql_matchscope Cross-Site Scripting

F5 FirePass 6.0.2.3 - vdeskadminconindex.php?sqlmatchscope Cross-Site Scripting source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting these...

F5 FirePass 6.0.2.3 - vdeskadminconwebyfiers.php?css_exceptions Cross-Site Scripting

F5 FirePass 6.0.2.3 - vdeskadminconwebyfiers.php?cssexceptions Cross-Site Scripting source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting thes...

F5 FirePass 6.0.2.3 - '/vdesk/admincon/webyfiers.php?css_exceptions' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29574/info F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input. Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of...

PR07-15: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.logon.php3' server-side script

Update: To exploit this in both firefox and IE requires an extra char "=" in the end. Using the same PoC URL we get: https://target.tld/my.logon.php3?"/scripttextareaHTMLinjectiontest/textarea!--= Client environment: firefox 2.0.0.11 and IE 6.0.2900.2180 Ricardo Martins, CISA Security Consultant...