The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
F5 BIG-IP Management Interface Perl Injection
------------------------------------------------------------------------
SUMMARY
The <http://www.f5.com/products/big-ip/> F5 BIG-IP reconfiguration
facility, used by both the web management interface and the CLI, suffers
from insufficient input validation and/or sensitization of certain
reconfiguration requests. It is possible for a logged-in user with
Resource Manager or Administrator privileges to inject arbitrary Perl
code, including spawning Unix shell commands, that gets immediately
executed with root privileges. (For the Administrator role this does not
provide any new privileges because it is already provided with full shell
access as root.)
DETAILS
Vulnerable Systems:
* F5 BIG-IP Management Interface version 9.4.3
The core of the problem is using Perl EP3 with templates containing
substitutions similar to
$val='NEW_VALUE';
without first escaping single quotes in NEW_VALUE;
As an example, the SNMP community string configuration accepts the
following value as an allowed source of SNMP requests:
"none'.`touch /etc/foo`.'"
It is possible to craft URL links that would inject the code with a simple
HTTP GET request. Cross-site attacks may leverage this vulnerability to
make an arbitrary change to the BIG-IP appliance.
ADDITIONAL INFORMATION
The information has been provided by <mailto:nnposter@disclosed.not>
nnposter.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
