full-disclosure - [FD] F5 BIG-IQ authed arbitrary user password change

Open Source and information security mailing list archives

Message-ID: <CAOJKFBCVg6H4wD52OKBTGvLbAYmxz_sDj2KUstsoBvETRG_WHQ@mail.gmail.com>
Date: Thu, 1 May 2014 17:10:40 -0500
From: Brandon Perry <bperry.volatile@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] F5 BIG-IQ authed arbitrary user password change

Hi,

Detailed at this blog post (with pics!) is a vulnerability within F5 BIG-IQ
4.1.0.2013.0.

http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html

A module for this will be uploaded to ExploitHub this evening that will
change the root users password and log in over SSH.

Tune in next week for even more F5 fun!

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives