SOL6804 - ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182

The FirePass controller provides anti-virus scanning of files uploaded through Portal Access from the ClamAV open source software . Scanning is enabled by selecting the Enable Standalone Virus Scanner option button on the Antivirus tab of the Portal Access: Content Inspection page. A vulnerabilit...

SOL6919 - Cross-site scripting vulnerability in my.activation.php3 CVE-2007-3097

A cross-site scripting XSS vulnerability exists in the FirePass my.activation.php3 logon page.The affected FirePass logon URL fails to fully sanitize certain URL arguments before the requested web page content is returned to the browser. It is possible for an attacker to create web pages, emails ...

SOL4583 - Insufficient validation of ICMP error messages - VU#222750 / CVE-2004-0790

This vulnerability describes the use of spoofed ICMP packets to affect existing TCP connections. An attacker could cause a TCP connection to be closed or slowed by interfering with the Path MTU Discovery process or by generating one of the following spoofed ICMP messages: Destination unreachable...

SOL6623 - OpenSSL signature vulnerability - CVE-2006-4339

This security advisory describes an OpenSSL signature vulnerability. Forged RSA signatures may be accepted during client certificate validations when the certificates are signed by certain Certificate Authority CA. This flaw could potentially cause F5 products to accept maliciously crafted client...

SOL6669 - Apache HTTP Expect header handling

The vulnerability exists in the Apache web server, which is used by FirePass. Apache will not sanitize the contents of the HTTP Expect header when receiving an HTTP request. Instead, the contents of the Expect header will be returned in a successful HTTP response. This permits executable code suc...

SOL6999 - Web browser domain-based security and discussion of "double eval()" and FP_DO_NOT_TOUCH tags - VU#261869

This potential vulnerability is discussed in the Web browser domain-based security section of this advisory. Additionally, the January 2007 security advisory 1 discusses a potential FirePass cross-site scripting vulnerability related to the double eval Javascript and FPDONOTTOUCH tags. This...

SOL6795 - ClamAV CHM Chunk Name Length DoS Vulnerability - CVE-2006-5295

The FirePass controller can be configured to provide anti-virus scanning of files uploaded through Portal Access using the ClamAV open source software. A vulnerability in ClamAV 0.88.4 and earlier versions could allow a remote attacker to crash the scanner process using a specially crafted...

SOL6579 - Cross-Site Scripting Vulnerability - ProCheckUp Security Bulletin PR06-04

ProCheckUp has informed F5 Networks of a potential Cross Site Scripting XSS vulnerability in some versions of the FirePass controller. The vulnerability exists in the login sequence of the Firepass controller. The affected FirePass pages fail to fully sanitize URL input before the web page conten...

SOL7005 - Overview of MNIN/NNL-Labs Advisory

Future release Obtaining and installing hotfixes F5 recommends you apply the following hotfixes for your specific FirePass version to address the issues presented in these security advisories: Product | Version | Hotfix ---|---|--- FirePass | 6.0.0 | HF-600-8 or later cumulative hotfix FirePass |...

SOL7164 - Execution of UNIX shell commands from a URL without authentication

A URL that is accessible without first authenticating to the FirePass controller may be modified to inject UNIX shell commands. Under certain conditions, the commands can then be executed with user-level privileges. Any attacker with access to the FirePass logon page can theoretically launch this...

SOL7147 - Execution of UNIX shell commands from the URL in the Admin UI

A URL that is accessible from the Device Management Maintenance Troubleshooting Tools page can be modified to inject UNIX shell commands, which are then executed with user-level privileges. Only FirePass Administrators with permission to access this URL can perform this action. Standard FirePass...

SOL7009 - Statement on ACL bypass using trailing NULL byte - MNIN/NNL Advisory

A January 2007 security advisory describes several security issues present in some versions of FirePass software. One section in the document, titled ACL Filter bypass with URL de-normalization, states that Portal Access ACL filters can be bypassed if a user appends a trailing NULL byte after the...

F5 Firepass多个输入验证漏洞

F5的FirePass服务器是一款可以通过任何标准Web浏览器为用户提供到公司网络安全接入的网络设备。 FirePass服务器存在多个跨站脚本攻击，远程攻击者可以利用漏洞获得目标用户敏感信息。 问题一是主要登录页面-my.logon.php3对用户提交的crs和xcho参数缺少过滤，吨斤毫秒度 恶意脚本代码作为参数数据，并诱使用户查看可导致脚本代码在目标浏览器上执行并泄露敏感信息。...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...

CVE-2007-0188

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer dword representation of an IP address "dotless IP address", which allows remote authenticated users to connect to the FirePass administrator console and certain other network...

Design/Logic Flaw

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer dword representation of an IP address "dotless IP address", which allows remote authenticated users to connect to the FirePass administrator console and certain other network...

CVE-2007-0195

my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account...

CVE-2007-0186

Multiple cross-site scripting XSS vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via 1 the xcho parameter to my.logon.php3; the 2 topblue, 3 midblue, 4 wtopblue, and certain other Custom color parameters in a per action to...

Directory traversal

F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via 1 a trailing null byte, 2 multiple leading slashes, 3 Unicode encoding, 4 URL-encoded directory traversal or same-directory characters, or 5 upper case letters in the domain name...

CVE-2007-0187

F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via 1 a trailing null byte, 2 multiple leading slashes, 3 Unicode encoding, 4 URL-encoded directory traversal or same-directory characters, or 5 upper case letters in the domain name...