F5 FirePass SSL VPN Multiple Cross-Site Request Forgery Vulnerabilities

Bugtraq ID:	29574
Class:	Input Validation Error
CVE:	CVE-2008-2637
Remote:	Yes
Local:	No
Published:	Jun 05 2008 12:00AM
Updated:	Apr 16 2015 05:59PM
Credit:	nnposter
Vulnerable:	F5 FirePass 6.0.2.3
Not Vulnerable:

F5 FirePass SSL VPN Multiple Cross-Site Request Forgery Vulnerabilities

F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of the affected application.

FirePass 6.0.2 hotfix 3 is vulnerable; other versions may also be affected.

F5 FirePass SSL VPN Multiple Cross-Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/29574.html

F5 FirePass SSL VPN Multiple Cross-Site Request Forgery Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

F5 FirePass SSL VPN Multiple Cross-Site Request Forgery Vulnerabilities

References:

• Firepass Homepage (F5)
  
• F5 FirePass Content Inspection Management XSS ([email protected])