CVE-2008-6474: Improper Control of Generation of Code

The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection...

SOL9761 - PHP vulnerability - CVE-2008-5557

A heap-based buffer overflow in PHP 4.3.0 through 5.2.6 may allow attackers to execute arbitrary code. Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without o...

SOL9754 - BIND 9 vulnerability CVE-2009-0025

BIND does not properly check the return value from the OpenSSL DSAverify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature. Information about this advisory is available at the following location: Note: The previous link takes y...

SOL9642 - Samba vulnerability CVE-2008-1105

Specifically crafted SMB responses can result in a heap overflow in the Samba client code. Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...

SOL9592 - bzip2 vulnerability CVE-2008-1372

Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge. F5 Product Development tracked this issue as CR114442 and CR107644 for BIG-IP LTM, GTM...

SOL2452 - Vulnerabilities in the HTTP TRACE method - VU#867593

Note: Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to SOL4602: Overview of F5 security vulnerability respons...

SOL9025 - FirePass SNMP DoS vulnerability

This SNMP vulnerability can at most cause DoS of the FirePass SNMP service and cannot cause either unprivileged access to the FirePass controller or DoS of other FirePass services. Information about this advisory is available at the following location: F5 Product Development tracked this issue a...

SOL8939 - SNMPv3 HMAC verification vulnerability CVE-2008-0960 - VU#878044

Information about this advisory is available at the following locations: F5 Product Development tracked this issue as CR99838 for BIG-IP LTM, GTM, ASM, PSM, Link Controller, and WebAccelerator and it was fixed in BIG-IP 9.4.6 and 10.0.0. For information about upgrading, refer to the BIG-IP LTM,...

Design/Logic Flaw

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

CVE-2008-3149

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

CVE-2008-3149

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

CVE-2008-3149

The CVE-2008-3149 entry affects the SNMP daemon in F5 FirePass 1200 (version 6.0.2 hotfix 3). The vulnerability arises from handling the HOST-RESOURCES-MIB hrSWInstalled OID branch, enabling remote attackers to cause a denial-of-service (daemon crash). Exploitation details, impacted versions beyo...

CVE-2008-3149: Improper Limitation of a Pathname to a Restricted Directory

The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service daemon crash by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB...

SOL8938 - BIND DNS cache poisoning vulnerability - CVE-2008-1447 - VU#800113

This security advisory describes a BIND 8 and BIND 9 vulnerability which allows remote attackers to spoof DNS traffic using cache poisoning techniques against recursive resolvers. With the exception of FirePass, the F5 products listed as affected in this security advisory run a version of BIND th...

F5 FirePass SNMP DoS

Crash on 1.3.6.1.2.1.25.6 traversing...

F5 FirePass 1200 SNMP daemon DoS

F5 FirePass 1200 SNMP daemon DoS Product: F5 FirePass 1200 http://www.f5.com/products/firepass/ The F5 FirePass 1200 SSL VPN appliance contains a denial-of-service vulnerability in the SNMP daemon. Traversing walking OID branch hrSWInstalled in HOST-RESOURCES-MIB OID 1.3.6.1.2.1.25.6 will cause t...

F5 FirePass SSL VPN SNMP守护程序远程拒绝服务漏洞

BUGTRAQ ID: 30090 CNCAN ID：CNCAN-2008070810 F5 FirePass SSL VPN设备允许用户安全的连接到关键业务应用设备上。 F5 FirePass 1200 SSL VPN应用设备包含的SNMP守护程序存在拒绝服务问题，远程攻击者可以利用漏洞使应用程序崩溃。 遍历HOST-RESOURCES-MIB OID 1.3.6.1.2.1.25.6中的hrSWInstalled OID分支可导致SNMP守护程序崩溃，目前不清楚是否可利用执行任意代码。 F5 FirePass 6.0.2.3 F5 FirePass 1200 目前没有解决方案提供：...

F5 FirePass SSL VPN多个跨站请求伪造漏洞

BUGTRAQ ID: 29574 CNCAN ID:CNCAN-2008061002 F5 FirePass SSL VPN是一款VPN实现。 F5 FirePass SSL VPN WEB接口不正确过滤用户提供的输入，远程攻击者可以利用漏洞进行跨站请求伪造攻击。 问题存在于/vdesk/admincon/webyfiers.php对cssexceptions参数的过滤及/vdesk/admincon/index.php对sqlmatchscope参数的过滤，由于不正确处理引号，允许攻击者注入恶意代码。 F5 FirePass 6.0.2.3 目前没有解决方案提供：...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...

CVE-2008-2637

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN 6.0.2 hotfix 3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via quotes in 1 the cssexceptions parameter in vdesk/admincon/webyfiers.php and 2 the sqlmatchscope parameter in...