Firepass

The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP scripts, a different vulnerability than CVE-2012-1777.

Published: 2012-04-04T10:00:00.000Z
Updated: 2024-08-06T19:17:27.650Z

SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.

Published: 2012-04-04T10:00:00.000Z
Updated: 2024-08-06T19:08:38.513Z

my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.

Published: 2007-01-11T02:00:00.000Z
Updated: 2024-08-07T12:12:17.464Z

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.

Published: 2007-01-11T02:00:00.000Z
Updated: 2024-08-07T12:12:17.674Z

F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letters in the domain name.

Published: 2007-01-11T02:00:00.000Z
Updated: 2024-08-07T12:12:17.761Z