Details of VAR-201204-0226

ID

VAR-201204-0226

CVE

CVE-2012-2053

TITLE

F5 FirePass of sudoers Vulnerability that can get permission in file

Trust: 0.8

sources: JVNDB: JVNDB-2012-001995

DESCRIPTION

The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP scripts, a different vulnerability than CVE-2012-1777. This vulnerability CVE-2012-1777 Is a different vulnerability.By local users sudo There is a possibility that the authority is acquired through the program. Firepass is prone to a local security vulnerability. This vulnerability has been verified by a user account capable of executing PHP scripts

Trust: 1.98

sources: NVD: CVE-2012-2053 // JVNDB: JVNDB-2012-001995 // BID: 78253 // VULHUB: VHN-55334

AFFECTED PRODUCTS

vendor:	f5	model:	firepass	scope:	eq	version:	7.0.0	Trust: 2.4
vendor:	f5	model:	firepass	scope:	eq	version:	6.0	Trust: 1.9
vendor:	f5	model:	firepass	scope:	eq	version:	6.1.0	Trust: 1.6
vendor:	f5	model:	firepass	scope:	eq	version:	6.0.0 to 6.1.0	Trust: 0.8
vendor:	f5	model:	firepass	scope:	eq	version:	7.0	Trust: 0.3
vendor:	f5	model:	firepass for linux	scope:	eq	version:	6.1	Trust: 0.3

sources: BID: 78253 // JVNDB: JVNDB-2012-001995 // CNNVD: CNNVD-201204-072 // NVD: CVE-2012-2053

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-2053
value:	HIGH
Trust: 1.0
NVD:	CVE-2012-2053
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201204-072
value:	HIGH
Trust: 0.6
VULHUB:	VHN-55334
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2012-2053
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-55334
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-55334 // JVNDB: JVNDB-2012-001995 // CNNVD: CNNVD-201204-072 // NVD: CVE-2012-2053

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-55334 // JVNDB: JVNDB-2012-001995 // NVD: CVE-2012-2053

THREAT TYPE

local

Trust: 0.9

sources: BID: 78253 // CNNVD: CNNVD-201204-072

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201204-072

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-001995

PATCH

title:

Top Page

url:

http://www.f5.com/

Trust: 0.8

sources: JVNDB: JVNDB-2012-001995

EXTERNAL IDS

db:	NVD	id:	CVE-2012-2053	Trust: 2.8
db:	JVNDB	id:	JVNDB-2012-001995	Trust: 0.8
db:	CNNVD	id:	CNNVD-201204-072	Trust: 0.7
db:	BID	id:	78253	Trust: 0.4
db:	VULHUB	id:	VHN-55334	Trust: 0.1

sources: VULHUB: VHN-55334 // BID: 78253 // JVNDB: JVNDB-2012-001995 // CNNVD: CNNVD-201204-072 // NVD: CVE-2012-2053

REFERENCES

url:	https://www.sec-consult.com/files/20120328-0_f5_firepass_ssl_vpn_unauthenticated_remote_root_v1.0.txt	Trust: 2.0
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/74813	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2053	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2053	Trust: 0.8

sources: VULHUB: VHN-55334 // BID: 78253 // JVNDB: JVNDB-2012-001995 // CNNVD: CNNVD-201204-072 // NVD: CVE-2012-2053

CREDITS

Unknown

Trust: 0.3

sources: BID: 78253

SOURCES

db:	VULHUB	id:	VHN-55334
db:	BID	id:	78253
db:	JVNDB	id:	JVNDB-2012-001995
db:	CNNVD	id:	CNNVD-201204-072
db:	NVD	id:	CVE-2012-2053

LAST UPDATE DATE

2024-11-23T22:31:32.922000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-55334	date:	2017-12-20T00:00:00
db:	BID	id:	78253	date:	2012-04-05T00:00:00
db:	JVNDB	id:	JVNDB-2012-001995	date:	2012-04-06T00:00:00
db:	CNNVD	id:	CNNVD-201204-072	date:	2012-04-09T00:00:00
db:	NVD	id:	CVE-2012-2053	date:	2024-11-21T01:38:23.740

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-55334	date:	2012-04-05T00:00:00
db:	BID	id:	78253	date:	2012-04-05T00:00:00
db:	JVNDB	id:	JVNDB-2012-001995	date:	2012-04-06T00:00:00
db:	CNNVD	id:	CNNVD-201204-072	date:	2012-04-09T00:00:00
db:	NVD	id:	CVE-2012-2053	date:	2012-04-05T14:55:05.747