ID

VAR-200507-0195

CVE

CVE-2005-2245

TITLE

F5 BIG-IP Unknown vulnerability

DESCRIPTION

Unknown vulnerability in F5 BIG-IP 9.0.2 through 9.1 allows attackers to "subvert the authentication of SSL transactions," via unknown attack vectors, possibly involving NATIVE ciphers. F5 BIG-IP is susceptible to an unspecified SSL authentication bypass vulnerability. It is conjectured that if the BIG-IP is configured to authenticate by utilizing certificate-based authentication, attackers may be able to bypass the requested authentication checks. This allows remote attackers to gain access to protected Web sites. Depending on the nature of the protected Web sites, various further attacks may also be possible. Further details are not currently available. This BID will be updated as more information is disclosed. Versions of BIP-IP from 9.0.2 through to 9.1 are affected. F5 BIG-IP is an all-in-one network device integrated with network traffic management, application security management, load balancing and other functions from F5 Corporation of the United States. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: BIG-IP Unspecified SSL Authentication Security Bypass SECUNIA ADVISORY ID: SA16008 VERIFY ADVISORY: http://secunia.com/advisories/16008/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: >From remote OPERATING SYSTEM: BIG-IP 9.x http://secunia.com/product/3158/ DESCRIPTION: A vulnerability has been reported in BIG-IP, which potentially can be exploited by malicious people to bypass certain security restrictions. SOLUTION: The vendor has issued a security update for versions 9.0.4, 9.0.5, and 9.1. ftp://ftp.f5.com/Domestic/bigip/bigip9x-hotfix-CR49528/ As a workaround, the vendor recommends temporarily disabling NATIVE ciphers on any clientssl or serverssl profiles that require or request authentication. This may result in a loss of SSL performance. PROVIDED AND/OR DISCOVERED BY: Reported by vendor. ORIGINAL ADVISORY: F5 Networks: http://tech.f5.com/home/bigip-next/solutions/security/sol4944.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

lack of information

EXTERNAL IDS

REFERENCES

CREDITS

The vendor disclosed this vulnerability.

SOURCES

LAST UPDATE DATE

2024-11-23T22:54:22.364000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE