Exploit for hardware platform in category remote exploits
Matta Consulting - Matta Advisory
https://www.trustmatta.com
F5 BIG-IP remote root authentication bypass Vulnerability
CVE reference: CVE-2012-1493
Affected platforms: BIG-IP platforms without SCCP
Version: 11.x 10.x 9.x
Date: 2012-February-16
Security risk: High
Vulnerability: F5 BIG-IP remote root authentication bypass
Researcher: Florent Daigniere
Vendor Status: Notified / Patch available
Vulnerability Disclosure Policy:
https://www.trustmatta.com/advisories/matta-disclosure-policy-01.txt
Permanent URL:
https://www.trustmatta.com/advisories/MATTA-2012-002.txt
=====================================================================
Description:
Vulnerable BIG-IP installations allow unauthenticated users to bypass
authentication and login as the 'root' user on the device.
The SSH private key corresponding to the following public key is
public and present on all vulnerable appliances:
ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJT+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbKv58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk=
SCCP Superuser
Its fingerprint is:
71:3a:b0:18:e2:6c:41:18:4e:56:1e:fd:d2:49:97:66
=====================================================================
Impact
If successful, a malicious third party can get full control of the
device with little to no effort. The Attacker might reposition and
launch an attack against other parts of the target infrastructure
from there.
=====================================================================
Versions affected:
BIG-IP version 11.1.0 build 1943.0 tested.
The vendor reports that the following versions are patched:
9.4.8-HF5 and later
10.2.4 and later
11.0.0-HF2 and later
11.1.0-HF3 and later
http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html
=====================================================================
Credits
This vulnerability was discovered and researched by Florent Daigniere
from Matta Consulting.
=====================================================================
History
16-02-12 initial discovery
22-02-12 initial attempt to contact the vendor
24-02-12 reply from David Wang, case C1062228 is open
24-02-12 draft of the advisory sent to the vendor
01-03-12 CVE-2012-1493 is assigned
06-04-12 James Affeld starts coordinating the notification effort
23-05-12 F5 notifies us that patches are ready
29-05-12 F5 sends advance notification to some customers
06-06-12 Public disclosure
=====================================================================
About Matta
Matta is a privately held company with Headquarters in London, and a
European office in Amsterdam. Established in 2001, Matta operates
in Europe, Asia, the Middle East and North America using a respected
team of senior consultants. Matta is an accredited provider of
Tiger Scheme training; conducts regular research and is the developer
behind the webcheck application scanner, and colossus network scanner.
https://www.trustmatta.com
https://www.trustmatta.com/training.html
https://www.trustmatta.com/webapp_va.html
https://www.trustmatta.com/network_va.html
=====================================================================
# 0day.today [2018-03-17] #