CVE-2012-1493

 

Published at: - 10-07-2012 12:55

Last modified: - 24-10-2022 03:32

Total changes: - 2

Description

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:L/Au:N/C:C/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb
• http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/
• http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html
• https://www.trustmatta.com/advisories/MATTA-2012-002.txt

 

Keywords

NVD

 

CVE-2012-1493

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures