PT-2015-4183

Name of the Vulnerable Software and Affected Versions F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller versions 11.5.0 through 11.6.0 F5 BIG-IP ASM versions 10.0.0 through 11.6.0 F5 BIG-IP PEM versions 11.3.0 through 11.6.0 Description The issue arises from the automatic signatur...

F5 BIG-IP ASM 11.4.1 Filter Bypass

Details ======= Product: F5 BIG-IP Application Security Manager ASM Vulnerability: Web Application Firewall Bypass Author: Peter Lapp, lappsec gmail com CVE: None assigned Vulnerable Versions: Confirmed 11.4.0, 11.4.1. Should apply to all releases. Fixed Version: None Summary ======= The F5 ASM i...

linux/x86 exit(0) polymorphic shellcode - 29 bytes

// linux/x86 exit0 polymorphic shellcode - 29 bytes // Febriyanto Nugroho include char shellcode = "\xeb\x11\x5e\x31\xc9\xb1\x24" "\x80\x6c\x0e\xff\x01\x80\xe9" "\x01\x75\xf6\xeb\x05\xe8\xea" "\xff\xff\xff\x6b\x1e\x5a\xce" "\x81"; int mainint argc, char argv asm"jmp %0;" : "=m" shellcode;...

TestDisk 6.14 - 'Check_OS2MB' Stack Buffer Overflow (PoC)

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. TestDisk 6.14 CheckOS2MB Stack Buffer Overflow Affected versions: TestDisk 6.14 - Linux, Windows and Mac OSX PDF:...

SOL16090 - BIG-IP Automatic Update Check and ASM Automatic Signature Update man-in-the-middle vulnerability CVE-2014-9326

The BIG-IP Phone Home and ASM Call Home automatic signature update functionality is susceptible to Man-in-the-Middle type attacks due to improper validation of server SSL certificates. CVE-2014-9326...

linux/x86 to see /proc/sys/kernel/randomize_va_space - 79 bytes

/ Exploit Title : linux/x86 execve"/bin/cat", "/bin/cat", "/proc/sys/kernel/randomizevaspace", NULL - 79 bytes Exploit Author : Febriyanto Nugroho Tested on : Linux Debian 5.0.5 / include char shellcode = "\x31\xdb" "\x6a\x17" "\x58" "\xcd\x80" "\x8d\x43\x0b" "\x99" "\x52" "\x68\x2f\x63\x61\x74"...

F5 Networks BIG-IP : Python vulnerability (K16398)

Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts. CVE-2006-4980 Impact An attacker may be able to...

Mozilla: Code execution through incorrect JavaScript bounds checking elimination (MFSA 2015-29)

The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to...

F5 BIG-IP - ASM cross-site scripting (XSS) vulnerability CVE-2015-1050

F5 BIG-IP is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if...

CVE-2015-1050

CVE-2015-1050 is a vulnerability in F5 BIG-IP ASM prior to version 11.6.0 where an attacker can inject arbitrary web script or HTML via the Response Body field during creation of a new user account. The public documentation indicates affected versions include 11.0.0–11.5.2 and earlier 10.x lines ...

[Corrected] Stored XSS Vulnerability in F5 BIG-IP Application Security Manager

Edit: Corrected the date in the timeline from 01/12/14 to 01/12/15. Details ======= Product: F5 BIG-IP Application Security Manager ASM Vulnerability: Cross Site Scripting Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Confirmed 11.4.0, 11.4.1. Likely 11.4.x-11.5.x...

CVE-2014-3570

The BNsqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to...

CVE-2014-3570: Undefined Security Weakness

The BNsqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to...

CVE-2014-8730

CVE-2014-8730 is listed in Brocade ASCG advisories as addressed by security updates; the connected document shows this CVE mapped to general remote services and notes fixes are provided via ASCG updates (e.g., 3.3.0/3.3.0a). The initial description describes a POODLE-style padding issue in SSL/TL...

CVE-2014-9342

CVE-2014-9342 is an XSS vulnerability in F5 BIG-IP pl_tree.php (ASM) affecting the tree view during automatic policy generation. Exploitation allows remote attackers to inject arbitrary script/HTML via a crafted URL. The advisory (SOL15939) confirms affected BIG-IP ASM releases and recommends mit...

F5 Networks BIG-IP : bzip2 vulnerability (SOL15878)

Integer overflow in the BZ2decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted compressed file. C Tenable Network Security, Inc. The descriptive te...

CVE-2014-6032

CVE-2014-6032 describes multiple XXE flaws in the Configuration utility of F5 BIG-IP products (LTM, ASM, GTM, Link Controller, AAM, ARM, Analytics, APM/Edge Gateway, PEM, PSM, WOM, Enterprise Manager) affecting versions ranging from 10.0.0 through 10.2.4 and 11.0.0 through 11.6.0 (and related hot...

F5 Networks BIG-IP : iControl vulnerability (K15220)

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 11.0.0 through 11.3.0, Enterprise Manager...

F5 Networks BIG-IP : MySQL vulnerabilities (SOL8178)

Information about these advisories is available at the following locations : %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL8178. The text description of this plugin is C F5 Networks...

F5 Networks BIG-IP : pam_ldap vulnerability (SOL6634)

The remote BIG-IP device is missing a patch required by a security advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL6634. The text description of this plugin is C F5 Networks...