F5 BIG-IP - Authentication Bypass (PoC)

        Matta Consulting - Matta Advisory

            https://www.trustmatta.com



F5 BIG-IP remote root authentication bypass Vulnerability



Advisory ID: MATTA-2012-002

CVE reference: CVE-2012-1493

Affected platforms: BIG-IP platforms without SCCP

Version: 11.x 10.x 9.x

Date: 2012-February-16

Security risk: High

Vulnerability: F5 BIG-IP remote root authentication bypass

Researcher: Florent Daigniere

Vendor Status: Notified / Patch available

Vulnerability Disclosure Policy:

 https://www.trustmatta.com/advisories/matta-disclosure-policy-01.txt

Permanent URL:

 https://www.trustmatta.com/advisories/MATTA-2012-002.txt



=====================================================================

Description:



Vulnerable BIG-IP installations allow unauthenticated users to bypass

 authentication and login as the 'root' user on the device. 



The SSH private key corresponding to the following public key is

 public and present on all vulnerable appliances:



ssh-rsa

AAAAB3NzaC1yc2EAAAABIwAAAIEAvIhC5skTzxyHif/7iy3yhxuK6/OB13hjPqrskogkYFrcW8OK4VJT+5+Fx7wd4sQCnVn8rNqahw/x6sfcOMDI/Xvn4yKU4t8TnYf2MpUVr4ndz39L5Ds1n7Si1m2suUNxWbKv58I8+NMhlt2ITraSuTU0NGymWOc8+LNi+MHXdLk=

 SCCP Superuser



Its fingerprint is:

71:3a:b0:18:e2:6c:41:18:4e:56:1e:fd:d2:49:97:66



=====================================================================

Impact



If successful, a malicious third party can get full control of the

 device with little to no effort. The Attacker might reposition and

 launch an attack against other parts of the target infrastructure

 from there.



=====================================================================

Versions affected:



BIG-IP version 11.1.0 build 1943.0 tested. 



The vendor reports that the following versions are patched:

    9.4.8-HF5 and later 

    10.2.4 and later 

    11.0.0-HF2 and later 

    11.1.0-HF3 and later 



http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html



=====================================================================

Credits



This vulnerability was discovered and researched by Florent Daigniere

 from Matta Consulting.



=====================================================================

History



16-02-12 initial discovery

22-02-12 initial attempt to contact the vendor

24-02-12 reply from David Wang, case C1062228 is open

24-02-12 draft of the advisory sent to the vendor

01-03-12 CVE-2012-1493 is assigned

06-04-12 James Affeld starts coordinating the notification effort

23-05-12 F5 notifies us that patches are ready

29-05-12 F5 sends advance notification to some customers

06-06-12 Public disclosure



=====================================================================

About Matta



Matta is a privately held company with Headquarters in London, and a

 European office in Amsterdam.   Established in 2001, Matta operates

 in Europe, Asia, the Middle East and North America using a respected

 team of senior consultants.  Matta is an accredited provider of

 Tiger Scheme training; conducts regular research and is the developer

 behind the webcheck application scanner, and colossus network scanner.



https://www.trustmatta.com

https://www.trustmatta.com/training.html

https://www.trustmatta.com/webapp_va.html

https://www.trustmatta.com/network_va.html



=====================================================================

Disclaimer and Copyright



Copyright (c) 2012 Matta Consulting Limited. All rights reserved.

This advisory may be distributed as long as its distribution is

 free-of-charge and proper credit is given.



The information provided in this advisory is provided "as is" without

 warranty of any kind. Matta Consulting disclaims all warranties, either

 express or implied, including the warranties of merchantability and

 fitness for a particular purpose. In no event shall Matta Consulting or

 its suppliers be liable for any damages whatsoever including direct,

 indirect, incidental, consequential, loss of business profits or

 special damages, even if Matta Consulting or its suppliers have been

 advised of the possibility of such damages.