Sign-up

ID

VAR-201601-0162


CVE

CVE-2015-8611


TITLE

plural F5 BIG-IP In product AOM Vulnerability to gain login access to

Trust: 0.8

sources: JVNDB: JVNDB-2015-006773

DESCRIPTION

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password. F5BIG-IP is a device product for application delivery services manufactured by F5Network, which is mainly used for load balancing, business acceleration optimization and other purposes. Multiple F5 BIG-IP products are prone to an insecure default-password vulnerability. An attacker with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks

Trust: 2.52

sources: NVD: CVE-2015-8611 // JVNDB: JVNDB-2015-006773 // CNVD: CNVD-2016-00292 // BID: 80385 // VULHUB: VHN-86572

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-00292

AFFECTED PRODUCTS

vendor:f5model:big-ip analyticsscope:eqversion:12.0.0

Trust: 3.0

vendor:f5model:big-ip link controllerscope:eqversion:12.0.0

Trust: 3.0

vendor:f5model:big-ip access policy managerscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip advanced firewall managerscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip application acceleration managerscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip application security managerscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip domain name systemscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip local traffic managerscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip policy enforcement managerscope:eqversion:12.0.0

Trust: 2.4

vendor:f5model:big-ip ltmscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip aamscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip afmscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip apmscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip asmscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip dnsscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip pemscope:eqversion:12.0.0

Trust: 0.6

vendor:f5model:big-ip pemscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip link controllerscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:12.0

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.4

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.3

Trust: 0.3

vendor:f5model:big-ip pem hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.4

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.2

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:10.2.4

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:10.2.3

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:10.2.2

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:10.2

Trust: 0.3

vendor:f5model:big-ip ltm hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.3.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.1.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:10.2.1

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:10.1.0

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.6

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.3

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.2.1

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.2

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.1

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.0

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:10.2.4

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:10.2.3

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:10.2.2

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:10.2.1

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:10.2

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:10.1

Trust: 0.3

vendor:f5model:big-ip link controller hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip dns hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.4

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.2

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.0

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:10.2.4

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:10.2.3

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:10.2.2

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:10.2.1

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:10.2

Trust: 0.3

vendor:f5model:big-ip asm hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.2.1

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:10.1.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.2

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:10.2.4

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:10.2.3

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:10.2.2

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:10.2

Trust: 0.3

vendor:f5model:big-ip apm hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.5.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.4.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.3.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.2.1

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.1.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:10.2.1

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:10.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.4

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.3

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.2.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.2

Trust: 0.3

vendor:f5model:big-ip analytics hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.1.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.0.0

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.4

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.3

Trust: 0.3

vendor:f5model:big-ip afm hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.5

Trust: 0.3

vendor:f5model:big-ip aam hf1scope:neversion:12.0.0

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.6.0

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.4.1

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.4.0

Trust: 0.3

sources: CNVD: CNVD-2016-00292 // BID: 80385 // JVNDB: JVNDB-2015-006773 // CNNVD: CNNVD-201601-194 // NVD: CVE-2015-8611

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-8611
value: CRITICAL

Trust: 1.0

NVD: CVE-2015-8611
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-00292
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201601-194
value: CRITICAL

Trust: 0.6

VULHUB: VHN-86572
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-8611
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-00292
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-86572
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-8611
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.0

sources: CNVD: CNVD-2016-00292 // VULHUB: VHN-86572 // JVNDB: JVNDB-2015-006773 // CNNVD: CNNVD-201601-194 // NVD: CVE-2015-8611

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-86572 // JVNDB: JVNDB-2015-006773 // NVD: CVE-2015-8611

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-194

TYPE

trust management

Trust: 0.6

sources: CNNVD: CNNVD-201601-194

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006773

PATCH
title:SOL05272632: BIG-IP AOM password sync vulnerability CVE-2015-8611url:https://support.f5.com/kb/en-us/solutions/public/k/05/sol05272632.html
Trust: 0.8
title:Patches for multiple F5BIG-IP product security bypass vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/70124
Trust: 0.6
title:Multiple F5 BIG-IP Repair measures for product trust management vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59546
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-00292 // 
            
            
            
            JVNDB: JVNDB-2015-006773 // 
            
            
            
            CNNVD: CNNVD-201601-194

EXTERNAL IDS
db:NVDid:CVE-2015-8611
Trust: 3.4
db:SECTRACKid:1034629
Trust: 1.7
db:JVNDBid:JVNDB-2015-006773
Trust: 0.8
db:CNNVDid:CNNVD-201601-194
Trust: 0.7
db:CNVDid:CNVD-2016-00292
Trust: 0.6
db:BIDid:80385
Trust: 0.4
db:VULHUBid:VHN-86572
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-00292 // 
            
            
            
            VULHUB: VHN-86572 // 
            
            
            
            BID: 80385 // 
            
            
            
            JVNDB: JVNDB-2015-006773 // 
            
            
            
            CNNVD: CNNVD-201601-194 // 
            
            
            
            NVD: CVE-2015-8611

REFERENCES
url:https://support.f5.com/kb/en-us/solutions/public/k/05/sol05272632.html
Trust: 2.6
url:http://www.securitytracker.com/id/1034629
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8611
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8611
Trust: 0.8
url:http://www.f5.com/products/big-ip/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-00292 // 
            
            
            
            VULHUB: VHN-86572 // 
            
            
            
            BID: 80385 // 
            
            
            
            JVNDB: JVNDB-2015-006773 // 
            
            
            
            CNNVD: CNNVD-201601-194 // 
            
            
            
            NVD: CVE-2015-8611

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 80385

SOURCES
db:CNVDid:CNVD-2016-00292
db:VULHUBid:VHN-86572
db:BIDid:80385
db:JVNDBid:JVNDB-2015-006773
db:CNNVDid:CNNVD-201601-194
db:NVDid:CVE-2015-8611

LAST UPDATE DATE
2024-11-23T22:01:35.181000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-00292date:2016-01-19T00:00:00
db:VULHUBid:VHN-86572date:2016-01-14T00:00:00
db:BIDid:80385date:2016-01-07T00:00:00
db:JVNDBid:JVNDB-2015-006773date:2016-01-15T00:00:00
db:CNNVDid:CNNVD-201601-194date:2016-01-15T00:00:00
db:NVDid:CVE-2015-8611date:2024-11-21T02:38:48.787

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-00292date:2016-01-19T00:00:00
db:VULHUBid:VHN-86572date:2016-01-12T00:00:00
db:BIDid:80385date:2016-01-07T00:00:00
db:JVNDBid:JVNDB-2015-006773date:2016-01-15T00:00:00
db:CNNVDid:CNNVD-201601-194date:2016-01-13T00:00:00
db:NVDid:CVE-2015-8611date:2016-01-12T20:59:04.667