F5 Multiple Products SSH Configuration Remote Unauthorized Access Vulnerability

Bugtraq ID:	53897
Class:	Design Error
CVE:	CVE-2012-1493
Remote:	Yes
Local:	No
Published:	Jun 08 2012 12:00AM
Updated:	Mar 19 2015 09:29AM
Credit:	Florent Daignier, Matta Consulting
Vulnerable:	F5 Enterprise Manager 2.3 F5 Enterprise Manager 2.2 F5 Enterprise Manager 1.4.1 F5 Enterprise Manager 2.0 F5 Enterprise Manager 1.8 F5 Enterprise Manager 1.6 F5 Enterprise Manager 1.4 F5 Enterprise Manager 1.2 F5 Enterprise Manager 1.0 F5 BigIP PSM 10.1 F5 BigIP PSM 10.0.1 F5 BigIP PSM 10.0 F5 BigIP PSM 9.4.8 F5 BigIP PSM 9.4.5 F5 BigIP Local Traffic Manager (LTM) 10.2.1 HF2 F5 BigIP Local Traffic Manager (LTM) 10.1 F5 BigIP Local Traffic Manager (LTM) 10.0.1 F5 BigIP Local Traffic Manager (LTM) 10.0 F5 BigIP Local Traffic Manager (LTM) 9.4.8 F5 BigIP Local Traffic Manager (LTM) 9.3.5 F5 BigIP Local Traffic Manager (LTM) 9.1.3 F5 BigIP Local Traffic Manager (LTM) 9.4 F5 BigIP Local Traffic Manager (LTM) 9.3.1 F5 BigIP Local Traffic Manager (LTM) 9.3 F5 BigIP Local Traffic Manager (LTM) 9.2 F5 BigIP Local Traffic Manager (LTM) 9.0 F5 BigIP Link Controller 10.1 F5 BigIP Link Controller 10.0.1 F5 BigIP Link Controller 10.0 F5 BigIP Link Controller 9.4.8 F5 BigIP Link Controller 9.3.1 F5 BigIP Link Controller 9.2.5 F5 BigIP Link Controller 9.2.2 F5 BigIP Link Controller 9.4 F5 BigIP Link Controller 9.3 F5 BigIP Global Traffic Manager (GTM) 9.4.8 F5 BigIP Global Traffic Manager (GTM) 9.3.1 F5 BigIP Global Traffic Manager (GTM) 9.2.5 F5 BigIP Global Traffic Manager (GTM) 9.2.2 F5 BigIP Global Traffic Manager (GTM) 9.4 F5 BigIP Global Traffic Manager (GTM) 9.3 F5 BigIP Application Security Manager (ASM) 10.1 F5 BigIP Application Security Manager (ASM) 10.0.1 F5 BigIP Application Security Manager (ASM) 10.0 F5 BigIP Application Security Manager (ASM) 9.4.8 F5 BigIP Application Security Manager (ASM) 9.3.1 F5 BigIP Application Security Manager (ASM) 9.2.5 F5 BigIP Application Security Manager (ASM) 9.4 F5 BigIP Application Security Manager (ASM) 9.3 F5 BigIP Application Security Manager (ASM) 9.2 F5 BigIP APM 10.1
Not Vulnerable:

F5 Multiple Products SSH Configuration Remote Unauthorized Access Vulnerability

Attackers can use readily available tools to exploit this issue.

The following exploits are available:

• /data/vulnerabilities/exploits/53897.rb
• /data/vulnerabilities/exploits/53897.py

F5 Multiple Products SSH Configuration Remote Unauthorized Access Vulnerability

Solution:
Updates are available. Please see the references for more information.

F5 Multiple Products SSH Configuration Remote Unauthorized Access Vulnerability

References:

• F5 BIG-IP remote root authentication bypass Vulnerability (Matta Consulting)
  
• F5 Networks Homepage (F5)
  
• sol13600: SSH vulnerability CVE-2012-1493 (Florent Daignier, Matta Consulting)