F5 BIG-IP Web Management Interface 'NEW_VALUE' Parameter Remote Code Injection Vulnerability

Bugtraq ID:	28639
Class:	Input Validation Error
CVE:	CVE-2008-6474
Remote:	Yes
Local:	No
Published:	Apr 05 2008 12:00AM
Updated:	May 07 2015 05:30PM
Credit:	nnposter is credited with the discovery of this vulnerability.
Vulnerable:	F5 BIG-IP Web Management Interface 9.4.3
Not Vulnerable:	F5 BIG-IP Web Management Interface 9.4.5

F5 BIG-IP Web Management Interface 'NEW_VALUE' Parameter Remote Code Injection Vulnerability

F5 BIG-IP Web Management Interface is prone to a remote code-injection vulnerability because the application fails to properly sanitize user-supplied input.

Exploiting this issue allows attackers to execute arbitrary code with the privileges of the user running the affected application.

This issue affects F5 BIG-IP 9.4.3; other versions may also be affected.

F5 BIG-IP Web Management Interface 'NEW_VALUE' Parameter Remote Code Injection Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

F5 BIG-IP Web Management Interface 'NEW_VALUE' Parameter Remote Code Injection Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

F5 BIG-IP Web Management Interface 'NEW_VALUE' Parameter Remote Code Injection Vulnerability

References:

• F5 BIG-IP Homepage (F5)
  
• F5 BIG-IP Management Interface Perl Injection ([email protected])