CVE-2014-2927 – cybernieuws.nl

Beschrijving NL

De rsync-daemon in F5 BIG-IP 11.6 vóór 11.6.0, 11.5.1 vóór HF3, 11.5.0 vóór HF4, 11.4.1 vóór HF4, 11.4.0 vóór HF7, 11.3.0 vóór HF9 en 11.2.1 vóór HF11 en Enterprise Manager 3.x vóór 3.1.1 HF2, wanneer geconfigureerd in failover-modus, vereist geen authenticatie, waardoor externe aanvallers willekeurige bestanden kunnen lezen of schrijven via een cmi-verzoek naar het ConfigSync IP-adres.

Origineel (Engels) tonen

The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

Vendors

F5

Affected products

Arx Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics Big-ip Application Acceleration Manager Big-ip Application Security Manager Big-ip Edge Gateway Big-ip Global Traffic Manager Big-ip Link Controller Big-ip Local Traffic Manager Big-ip Policy Enforcement Manager Big-ip Protocol Security Module Big-ip Wan Optimization Manager Big-ip Webaccelerator Big-iq Cloud Big-iq Device Big-iq Security Enterprise Manager Firepass

Beschrijving NL

Vendors

Affected products

References