SOL7983 - ClamAV NULL dereference vulnerability - CVE-2007-4510

The FirePass controller can be configured to provide anti-virus scanning of files uploaded through Portal Access through the ClamAV open source software. Scanning is configured on the Antivirus tab of the Portal Access Content Inspection page, through the Enable Standalone virus Scanner option...

SOL7859 - Multiple PHP vulnerabilities

PHP has been cited with multiple vulnerabilities. For information about these vulnerabilities, refer to the National Vulnerabilities Database. Information about these advisories is available at the following locations: CVE-2007-1846 SQL injection vulnerability in index.php in the MyAds 2.04jp and...

SOL7923 - Cross-site scripting vulnerability in the logon page after enabling a pre-logon sequence - CVE-2007-6704

A cross-site scripting XSS vulnerability—CVE-2007-6704—exists in the FirePass logon page when a pre-logon sequence is enabled. The affected FirePass URL fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web pages,...

SOL7886 - Remote vulnerability in the mod_jk2 Apache module, VU #771937

A vulnerability exists in the legacy version of the modjk2 Apache module. If successfully exploited, an attacker may be able to run arbitrary code on affected system. Information about this advisory is available at the following location: F5 Product Development tracked this issue as CR83564 and i...

SOL7854 - Web Applications Content Processing Scripts vulnerability

F5 Product Development tracked this issue as CR81839 and it was fixed in FirePass 6.0.2. For information about upgrading, refer to the FirePass release notes. Additionally, cumulative hotfix HF-552-10 has been issued for FirePass 5.5.2, cumulative hotfix HF-600-15 has been issued for FirePass 6.0...

SOL7827 - tcpdump 3.9.6 vulnerability CVE-2007-3798

For information about this advisory, refer to the Common Vulnerabilities and Exposures website at the following location:...

SOL7593 - Command injection into F5 ActiveX control

A vulnerability exists in an F5 ActiveX control. The ActiveX control is downloaded to a Windows client system when you log in to a FirePass controller, which is configured for specific pre-logon sequence functionality. The ActiveX control could run executables that reside on the system if an...

SOL7544 - Full-width and half-width Unicode encoded data bypasses IDS/IPS security controls, VU #739224

Unicode is a system for encoding characters of a character set, which is used in networked applications. IDS/IPS or other security devices may fail to decode and recognize the characters that represent an attack if encoded in Unicode, and pass the characters to a target device. If the target devi...

SOL7521 - Stack-based buffer overflow vulnerability in web browser plug-in

In order for this exploit to be successful, the attacker must persuade you to view the malicious web page. If you view the malicious web page in a browser that has affected FirePass plug-in installed, this could result in malicious code execution on the client side, disclosure of sensitive...

SOL7529 - Stack-based buffer overflow vulnerability in ActiveX control

FirePass 5.5 is not affected, but the following hotfixes for version 5.5 are affected: HF-59313-57605-55025-61183-61531-61155-1 HF-59313-57605-55025-61183-61531-61155-55266-1 HF-59313-57605-55025-61183-61531-61155-55266-63623-1 HF-59313-57605-55025-61183-61531-61155-55266-63623-2 FirePass 5.5.1 i...

SOL7528 - Heap-based buffer overflow vulnerability in ActiveX control

A heap-based buffer overflow vulnerability exists in the FirePass ActiveX control. This ActiveX control is installed in Microsoft Internet Explorer when a user logs on to FirePass. In some configurations, this control may be installed at the FirePass logon page prior to authentication. It is...

SOL7498 - Cross-site scripting vulnerability in download_plugin.php3 page

A cross-site scripting XSS vulnerability exists in the FirePass downloadplugin.php3 page, which is accessible prior to authentication. For example: https://firepass.siterequest.com/downloadplugin.php3 The downloadplugin.php3 page fails to fully sanitize URL input before the web page content is se...

SOL2617 - Reverse name resolution vulnerability in SSH - CVE-2003-0386

OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address...

SOL7397 - Download of local FirePass files using the URL in Webtop or the Admin UI

A vulnerability exists that allows an authenticated FirePass user to download files from the filesystem of a FirePass controller. In order to download a file, the user must first log in to the FirePass controller webtop or the Admin UI, and type a specially crafted URL into their web browser. Thi...

SOL1933 - Multiple Vulnerabilities in OpenSSL - CAN-2002-23

Information about this advisory can be found at the following location:...

SOL2355 - Timing attacks on RSA private keys - CAN-2003-0147

Information about this advisory can be found at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...

SOL5873 - PAM conversation stack corruption in OpenSSH - CVE-2003-0787

Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...

SOL2104 - Buffer read overflow in DNS resolver libraries - CAN-2002-1146

Information about this vulnerability can be found at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...

SOL2232 - checktrap.pl script may be vulnerable to remote command execution

The checktrap.pl script may be vulnerable to remote command execution. F5 Networks Product Development tracked this issue as CR35371 and CR35372, and it was fixed in BIG-IP and 3-DNS version 4.5.12 for the 4.5 software branches and in version 4.6.3 for the 4.6 software branches. Obtaining and...

SOL5716 - Authentication bypass in PAM LDAP module - CAN-2005-2641

Vulnerability description: Vulnerability in pamldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges. Information about this advisory is available at the following locations: US-CERT Vulnerability Note VU778916 pamldap authenticatio...

SOL1907 - mod_ssl and Apache_SSL buffer overflow - CAN-2002-0082

Information about this vulnerability can be found at the following location:...

SOL2319 - Insufficient MAC computation in OpenSSH - CAN-2003-0078

Obtaining and installing patches F5 has released a patch for BIG-IP and 3-DNS versions 4.2 and 4.5. To download the patch, perform the following procedure 1. Open the F5 Downloads page in a browser. 2. Navigate to the BIG-IP BIG-IP v4.x 4.5.x section. 3. Click CAN-2003-0078 and download the...

SOL3279 - Heap-based buffer overflow in mod_proxy - CAN-2004-0492

Heap-based buffer overflow in proxyutil.c for modproxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service process crash and possibly execute arbitrary code by way of a negative Content-Length HTTP header field, which causes a large amount of data to be copied...

SOL6623 - OpenSSL signature vulnerability - CVE-2006-4339

This security advisory describes an OpenSSL signature vulnerability. Forged RSA signatures may be accepted during client certificate validations when the certificates are signed by certain Certificate Authority CA. This flaw could potentially cause F5 products to accept maliciously crafted client...

SOL3126 - Large TCP window sizes may make it easier to predict sequence numbers vulnerability CVE-2004-0230

This vulnerability is found in the principle design of TCP/IP itself and cannot be completely corrected without changing to an alternate protocol. The central issue in this vulnerability is that for long-lived connections, as measured in hours or days, an outside attacker could send a flurry of R...

SOL2339 - Remote Buffer Overflow in Sendmail - CA-2003-07

If you have configured sendmail as a daemon that is, it is listening on port 25 and relays mail, you can use the /etc/hosts.allow file to restrict access to the daemon from trusted hosts...

SOL5576 - Authentication vulnerability in Apache mod_digest - CAN-2003-0987

Vulnerability description moddigest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret. Information about this advisory is available at the following location:...

SOL5533 - Potential protocol version rollback vulnerability in OpenSSL - CVE-2005-2969

It is possible that customers using non-default SSL options could be exposed to this vulnerability in the BIG-IP LTM Configuration utility, SSL terminating virtual servers, and bundled utilities. F5 tracked this problem as CR55070, CR55145, CR55203, CR55204, CR55283, CR55426, CR55588, and CR63465...

SOL6919 - Cross-site scripting vulnerability in my.activation.php3 CVE-2007-3097

A cross-site scripting XSS vulnerability exists in the FirePass my.activation.php3 logon page.The affected FirePass logon URL fails to fully sanitize certain URL arguments before the requested web page content is returned to the browser. It is possible for an attacker to create web pages, emails ...

SOL6804 - ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182

The FirePass controller provides anti-virus scanning of files uploaded through Portal Access from the ClamAV open source software . Scanning is enabled by selecting the Enable Standalone Virus Scanner option button on the Antivirus tab of the Portal Access: Content Inspection page. A vulnerabilit...

SOL4447 - cURL buffer overflow vulnerability - CAN-2005-0490

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by 1 the Curlinputntlm functio...

SOL4232 - BIND version 8.4.4 and 8.4.5 vulnerability - CAN-2005-0033

A buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service. Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the...

SOL5868 - Buffer overflow vulnerability in cURL - CVE-2005-4077

Because an attacker would require root access to exploit this vulnerability, it is considered to be a minor risk. You can find information about this advisory at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be remove...

SOL6669 - Apache HTTP Expect header handling

The vulnerability exists in the Apache web server, which is used by FirePass. Apache will not sanitize the contents of the HTTP Expect header when receiving an HTTP request. Instead, the contents of the Expect header will be returned in a successful HTTP response. This permits executable code suc...

SOL4369 - Configuration utility login vulnerability - CR45786

BIG-IP 9.0.2 through 9.0.4 cache login credentials for the Configuration utility. Once a user is logged in, the cache does not check the password entered for additional sessions under that user name. As a result, it is possible to gain access to the BIG-IP Configuration utility without a password...

SOL1989 - Apache/mod_ssl Worm vulnerability CA-2002-27

CERT Advisory CA-2002-27 reports a vulnerability that affects many operating systems. For more information about the vulnerability, refer to the following CERT website:...

SOL5165 - rsync directory traversal vulnerability - CAN-2004-0792

Directory traversal vulnerability in the sanitizepath function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files. Information about this advisory is available at the following location:...

SOL1956 - Integer Overflow In XDR Library - CA-2002-25

Information about this advisory can be found at the following location:...

SOL1882 - Buffer Overflows in DNS Resolver Libraries vulnerability CAN-2002-19

CERT has released an advisory regarding a buffer overflow in the way that stub resolvers handle DNS responses. Malicious users could use this exploit to cause a denial-of-service DoS attack or possibly run arbitrary code on the system. For more information about this advisory, refer to the...

SOL5835 - Security Advisory: Possible kernel memory vulnerability in the sendfile() system call - CVE-2005-0708

Vulnerability description The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 can transfer portions of kernel memory if a file is truncated while it is being sent, which could allow remote attackers to obtain sensitive information. Information about this advisory is available a...

SOL6734 - Local OpenSSL vulnerabilities VU#547300 and VU#386964, CAN-2006-3738, CAN-2006-2940, CAN-2006-2937, CAN-2006-4343

This security advisory describes the following local OpenSSL vulnerabilities: Denial of Service Attacks CVE-2006-2937, CVE-2006-2940 SSLgetsharedciphers buffer overflow CVE-2006-3738 SSLv2 Client Crash CVE-2006-4343 Information about this advisory is available at the following location: Note: Thi...

SOL1518 - Multiple SSH1 vulnerabilities - CA-2001-35

CERT Advisory CA-2001-35 revisits several existing exploits for the SSH1 and SSH2 protocols handled by the sshd process. For more information about the vulnerability, refer to the CERT website at the following location: . Workaround If you have BIG-IP or 3-DNS 4.5, you can work around these issue...

SOL4207 - Buffer overflow in mod_include - CAN-2004-0940

The version of modinclude used in BIG-IP and 3-DNS versions prior to 4.5.12 and 4.6.3 is vulnerable, but it is not enabled by default and is not enabled by using any BIG-IP or 3-DNS features. To enable modinclude, you must modify the httpd.conf file and then install HTML pages that use modinclude...

SOL5860 - GSSAPI authentication vulnerability in OpenSSH - CAN-2005-2798

CAN-2005-2798: GSSAPI authentication vulnerability in OpenSSH Information about this advisory is available at the following location:...

SOL3015 - FIPS hardware vulnerability - nCipher Advisory #9 - CAN-2004-0320

Information about this advisory is available at the following location:...

SOL6999 - Web browser domain-based security and discussion of "double eval()" and FP_DO_NOT_TOUCH tags - VU#261869

This potential vulnerability is discussed in the Web browser domain-based security section of this advisory. Additionally, the January 2007 security advisory 1 discusses a potential FirePass cross-site scripting vulnerability related to the double eval Javascript and FPDONOTTOUCH tags. This...

SOL6339 - Sendmail race condition - VU#834865

F5 Networks Product Development tracked this issue and it was fixed in BIG-IP and 3-DNS version 4.5.11 for the 4.5 software branch and in version 4.6.2 for the 4.6 software branch. F5 Networks Product Development tracked this issue and it was fixed in WebAccelerator version 5.2 for the 5.x softwa...

SOL4119 - Buffer overflow in mod_ssl - CVE-2002-0082

Information about this advisory is available at the following location: Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge...

SOL4583 - Insufficient validation of ICMP error messages - VU#222750 / CVE-2004-0790

This vulnerability describes the use of spoofed ICMP packets to affect existing TCP connections. An attacker could cause a TCP connection to be closed or slowed by interfering with the Path MTU Discovery process or by generating one of the following spoofed ICMP messages: Destination unreachable...

SOL4743 - Inadequate validation for TCP segments CVE-2005-0356

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers PAWS with the timestamps option enabled allow remote attackers to cause a denial of service connection loss via a spoofed packet with a large timer value, which causes the host to discard later packets because they appe...