CVE-2014-2927
9.3
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
Exploitability: 8.6 / Impact: 10.0
Source: NVD
Description
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.
Affected (195)
Products: F5: Arx, Big Ip Access Policy Manager, Big Ip Advanced Firewall Manager, Big Ip Analytics, Big Ip Application Acceleration Manager, Big Ip Application Security Manager, Big Ip Edge Gateway, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Local Traffic Manager, Big Ip Policy Enforcement Manager, Big Ip Protocol Security Module, Big Ip Wan Optimization Manager, Big Ip Webaccelerator, Big Iq Cloud, Big Iq Device, Big Iq Security, Enterprise Manager, Firepass
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 6.0.0 | |
| Version 10.1.0 | |
| Version 11.3.0 | |
| Version 11.0.0 | |
| Version 11.4.0 | |
| Version 10.0.0 | |
| Version 10.1.0 | |
| Version 10.0.0 | |
| Version 10.0.0 | |
| Version 10.0.0 | |
| Version 11.3.0 | |
| Version 10.0.0 | |
| Version 10.0.0 | |
| Version 10.0.0 | |
| Version 4.0.0 | |
| Version 4.2.0 | |
| Version 4.0.0 | |
| Version 2.1.0 | |
| Version 6.0.0 |
References (6)
Source: cret@cert.org
Exploit
Source: cret@cert.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.