5864 matches found
SOL6804 - ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182
The FirePass controller provides anti-virus scanning of files uploaded through Portal Access from the ClamAV open source software . Scanning is enabled by selecting the Enable Standalone Virus Scanner option button on the Antivirus tab of the Portal Access: Content Inspection page. A vulnerabilit...
SOL6339 - Sendmail race condition - VU#834865
F5 Networks Product Development tracked this issue and it was fixed in BIG-IP and 3-DNS version 4.5.11 for the 4.5 software branch and in version 4.6.2 for the 4.6 software branch. F5 Networks Product Development tracked this issue and it was fixed in WebAccelerator version 5.2 for the 5.x softwa...
SOL2379 - Klima-Pokorny-Rosa attack on RSA vulnerability CAN-2003-0131
F5 Product Development tracked this issue and it was fixed in BIG-IP and 3-DNS versions 4.5.11 and 4.6.2...
SOL6579 - Cross-Site Scripting Vulnerability - ProCheckUp Security Bulletin PR06-04
ProCheckUp has informed F5 Networks of a potential Cross Site Scripting XSS vulnerability in some versions of the FirePass controller. The vulnerability exists in the login sequence of the Firepass controller. The affected FirePass pages fail to fully sanitize URL input before the web page conten...
SOL4447 - cURL buffer overflow vulnerability - CAN-2005-0490
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by 1 the Curlinputntlm functio...
SOL3277 - mod_ssl and ssl_log vulnerability VU#303448
Information about this advisory is available at the following location: F5 Product Development tracked this issue and it was fixed in BIG-IP and 3-DNS version 4.5.11 and 4.6.2. For instructions about downloading software from F5, refer to SOL167: Downloading software from F5. A VU303448 patch has...
SOL7005 - Overview of MNIN/NNL-Labs Advisory
Future release Obtaining and installing hotfixes F5 recommends you apply the following hotfixes for your specific FirePass version to address the issues presented in these security advisories: Product | Version | Hotfix ---|---|--- FirePass | 6.0.0 | HF-600-8 or later cumulative hotfix FirePass |...
SOL7164 - Execution of UNIX shell commands from a URL without authentication
A URL that is accessible without first authenticating to the FirePass controller may be modified to inject UNIX shell commands. Under certain conditions, the commands can then be executed with user-level privileges. Any attacker with access to the FirePass logon page can theoretically launch this...
SOL7053 - BIND 9 vulnerabilities - Dereferencing freed fetch context and DNSSEC Validation
This Solution describes vulnerability issues reported in BIND where a remote user can cause denial of service conditions by sending specifically crafted packets to the BIND server. The dereferencing freed fetch context issue results from an issue where the named daemon dereferences a freed fetch...
SOL7009 - Statement on ACL bypass using trailing NULL byte - MNIN/NNL Advisory
A January 2007 security advisory describes several security issues present in some versions of FirePass software. One section in the document, titled ACL Filter bypass with URL de-normalization, states that Portal Access ACL filters can be bypassed if a user appends a trailing NULL byte after the...
F5 Firepass多个输入验证漏洞
F5的FirePass服务器是一款可以通过任何标准Web浏览器为用户提供到公司网络安全接入的网络设备。 FirePass服务器存在多个跨站脚本攻击，远程攻击者可以利用漏洞获得目标用户敏感信息。 问题一是主要登录页面-my.logon.php3对用户提交的crs和xcho参数缺少过滤，吨斤毫秒度 恶意脚本代码作为参数数据，并诱使用户查看可导致脚本代码在目标浏览器上执行并泄露敏感信息。...
CVE-2007-0195
my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...
Directory traversal
F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via 1 a trailing null byte, 2 multiple leading slashes, 3 Unicode encoding, 4 URL-encoded directory traversal or same-directory characters, or 5 upper case letters in the domain name...
Design/Logic Flaw
F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer dword representation of an IP address "dotless IP address", which allows remote authenticated users to connect to the FirePass administrator console and certain other network...
CVE-2007-0187
F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via 1 a trailing null byte, 2 multiple leading slashes, 3 Unicode encoding, 4 URL-encoded directory traversal or same-directory characters, or 5 upper case letters in the domain name...
CVE-2007-0188
F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer dword representation of an IP address "dotless IP address", which allows remote authenticated users to connect to the FirePass administrator console and certain other network...
CVE-2007-0186
Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...
[SA23626] FirePass URL Restriction Bypass
TITLE: FirePass URL Restriction Bypass SECUNIA ADVISORY ID: SA23626 VERIFY ADVISORY: http://secunia.com/advisories/23626/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote OPERATING SYSTEM: FirePass 6.x http://secunia.com/product/13146/ FirePass 5.x...