SOL7521 - Stack-based buffer overflow vulnerability in web browser plug-in

In order for this exploit to be successful, the attacker must persuade you to view the malicious web page. If you view the malicious web page in a browser that has affected FirePass plug-in installed, this could result in malicious code execution on the client side, disclosure of sensitive...

SOL7529 - Stack-based buffer overflow vulnerability in ActiveX control

FirePass 5.5 is not affected, but the following hotfixes for version 5.5 are affected: HF-59313-57605-55025-61183-61531-61155-1 HF-59313-57605-55025-61183-61531-61155-55266-1 HF-59313-57605-55025-61183-61531-61155-55266-63623-1 HF-59313-57605-55025-61183-61531-61155-55266-63623-2 FirePass 5.5.1 i...

F5 FirePass 4100 SSL VPN My.Activiation.PHP3远程命令注入漏洞

F5's FirePass SSL VPN提供使用标准WEB浏览器对应用程序和数据进行安全访问的解决方案。 F5 FirePass 4100不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'my.activation.php3'脚本对用户提交的'username'参数缺少过滤，在部分条件下允许用户注入Linux SHELL命令，导致以WEB权限执行。 F5 FirePass 4100 厂商解决方案 可参考如下安全公告获得补丁信息： https://tech.f5.com/home/solutions/sol167.html...

Design/Logic Flaw

my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter...

CVE-2007-3097

my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter...

CVE-2007-3097

FirePass (4100 SSL VPN) my.activation.php3 login page suffers a cross-site scripting (XSS) vulnerability due to insufficient sanitization of URL arguments, enabling attacker-controlled HTML/JavaScript when a user follows a crafted link. F5 advisory SOL6919 states this was fixed in maintenance ver...

S21Sec-035: F5 FirePass command execution vulnerability

S21Sec Advisory - Title: F5 FirePass command execution vulnerability ID: S21SEC-035-en Severity: High - Intrusion History: 14.Feb.2007 Vulnerability discovered 22.Feb.2007 Vendor contacted Scope: Linux's shell Command Execution Platforms: Linux based Appliance Author: Leonardo Nve [email protected]...

F5 Firepass SSL VPN unfiltered shell characters security vulnerabilities

Shell characters problem via username parameter of my.activation.php3 script...

SOL7528 - Heap-based buffer overflow vulnerability in ActiveX control

A heap-based buffer overflow vulnerability exists in the FirePass ActiveX control. This ActiveX control is installed in Microsoft Internet Explorer when a user logs on to FirePass. In some configurations, this control may be installed at the FirePass logon page prior to authentication. It is...

SOL7498 - Cross-site scripting vulnerability in download_plugin.php3 page

A cross-site scripting XSS vulnerability exists in the FirePass downloadplugin.php3 page, which is accessible prior to authentication. For example: https://firepass.siterequest.com/downloadplugin.php3 The downloadplugin.php3 page fails to fully sanitize URL input before the web page content is se...

SOL4009 - Vulnerabilities in libpng - CAN-2004-0597, CAN-2004-0598, CAN-2004-0599

These vulnerabilities are described as methods under which an attacker could generate a PNG file that would cause applications that use libpng to execute arbitrary code. Since an attacker would require root access to the BIG-IP or 3-DNS in order to exploit this vulnerability, it is considered to ...

SOL3277 - mod_ssl and ssl_log vulnerability VU#303448

Information about this advisory is available at the following location: F5 Product Development tracked this issue and it was fixed in BIG-IP and 3-DNS version 4.5.11 and 4.6.2. For instructions about downloading software from F5, refer to SOL167: Downloading software from F5. A VU303448 patch has...

SOL6623 - OpenSSL signature vulnerability - CVE-2006-4339

This security advisory describes an OpenSSL signature vulnerability. Forged RSA signatures may be accepted during client certificate validations when the certificates are signed by certain Certificate Authority CA. This flaw could potentially cause F5 products to accept maliciously crafted client...

SOL2319 - Insufficient MAC computation in OpenSSH - CAN-2003-0078

Obtaining and installing patches F5 has released a patch for BIG-IP and 3-DNS versions 4.2 and 4.5. To download the patch, perform the following procedure 1. Open the F5 Downloads page in a browser. 2. Navigate to the BIG-IP BIG-IP v4.x 4.5.x section. 3. Click CAN-2003-0078 and download the...

SOL6579 - Cross-Site Scripting Vulnerability - ProCheckUp Security Bulletin PR06-04

ProCheckUp has informed F5 Networks of a potential Cross Site Scripting XSS vulnerability in some versions of the FirePass controller. The vulnerability exists in the login sequence of the Firepass controller. The affected FirePass pages fail to fully sanitize URL input before the web page conten...

SOL6804 - ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182

The FirePass controller provides anti-virus scanning of files uploaded through Portal Access from the ClamAV open source software . Scanning is enabled by selecting the Enable Standalone Virus Scanner option button on the Antivirus tab of the Portal Access: Content Inspection page. A vulnerabilit...

SOL2232 - checktrap.pl script may be vulnerable to remote command execution

The checktrap.pl script may be vulnerable to remote command execution. F5 Networks Product Development tracked this issue as CR35371 and CR35372, and it was fixed in BIG-IP and 3-DNS version 4.5.12 for the 4.5 software branches and in version 4.6.3 for the 4.6 software branches. Obtaining and...

SOL6919 - Cross-site scripting vulnerability in my.activation.php3 CVE-2007-3097

A cross-site scripting XSS vulnerability exists in the FirePass my.activation.php3 logon page.The affected FirePass logon URL fails to fully sanitize certain URL arguments before the requested web page content is returned to the browser. It is possible for an attacker to create web pages, emails ...

SOL6339 - Sendmail race condition - VU#834865

F5 Networks Product Development tracked this issue and it was fixed in BIG-IP and 3-DNS version 4.5.11 for the 4.5 software branch and in version 4.6.2 for the 4.6 software branch. F5 Networks Product Development tracked this issue and it was fixed in WebAccelerator version 5.2 for the 5.x softwa...

SOL4207 - Buffer overflow in mod_include - CAN-2004-0940

The version of modinclude used in BIG-IP and 3-DNS versions prior to 4.5.12 and 4.6.3 is vulnerable, but it is not enabled by default and is not enabled by using any BIG-IP or 3-DNS features. To enable modinclude, you must modify the httpd.conf file and then install HTML pages that use modinclude...