CVE-2007-0188

F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html
http://secunia.com/advisories/23640
http://www.mnin.org/advisories/2007_firepass.pdf
http://www.osvdb.org/32734
http://www.securityfocus.com/bid/21957
https://tech.f5.com/home/solutions/sol6922.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:f5:firepass:5.4:::::::*
	cpe:2.3:h:f5:firepass:5.4.1:::::::*
	cpe:2.3:h:f5:firepass:5.4.2:::::::*
	cpe:2.3:h:f5:firepass:5.4.3:::::::*
	cpe:2.3:h:f5:firepass:5.4.4:::::::*
	cpe:2.3:h:f5:firepass:5.4.5:::::::*
	cpe:2.3:h:f5:firepass:5.4.6:::::::*
	cpe:2.3:h:f5:firepass:5.4.7:::::::*
	cpe:2.3:h:f5:firepass:5.4.8:::::::*
	cpe:2.3:h:f5:firepass:5.4.9:::::::*
	cpe:2.3:h:f5:firepass:5.5:::::::*
	cpe:2.3:h:f5:firepass:5.5.1:::::::*
	cpe:2.3:h:f5:firepass:5.5.2:::::::*
	cpe:2.3:h:f5:firepass:6.0:::::::*

History

No history.

Information

Published : 2007-01-12 05:04

Updated : 2023-12-10 10:40

NVD link : CVE-2007-0188

Mitre link : CVE-2007-0188

CVE.ORG link : CVE-2007-0188

JSON object : View

Products Affected

f5

firepass

CWE

NVD-CWE-Other

{"id": "CVE-2007-0188", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-01-12T05:04:00.000", "references": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/23640", "source": "cve@mitre.org"}, {"url": "http://www.mnin.org/advisories/2007_firepass.pdf", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/32734", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21957", "source": "cve@mitre.org"}, {"url": "https://tech.f5.com/home/solutions/sol6922.html", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address (\"dotless IP address\"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources."}, {"lang": "es", "value": "F5 FirePass 5.4 hasta 5.5.1 no implementa apropiadamente restricciones de acceso al servidor cuando un cliente utiliza un entero simple (dword) para la representaci\u00f3n de una direcci\u00f3n IP (\"Direcci\u00f3n IP sin puntos\"), lo cual permite a atacantes remotos autenticados conectarse a la consola de administraci\u00f3n FirePass y a otros recursos concretos de red."}], "lastModified": "2008-09-05T21:17:14.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:f5:firepass:5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D1F4903-B7FB-4F0E-A4F0-5BC813F5BA22"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD7A44F4-212D-445E-A283-8CC68C7415DE"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BEFC14C-CD35-43BD-BCC9-CD437DAC688D"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAE893BF-A7DA-4FEC-9290-0FD202EC0D8F"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3347FD7A-49F6-464B-A3DA-4D9DD8B0955C"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34DE479A-5D1B-4A21-94AE-D613BA9E6120"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9767F21-1539-4313-B2DA-2D368CADDA66"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0286D438-6F1B-4D91-9A5B-CF12FEDDF427"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ADF9E53-79F7-4678-A599-20385EEF993C"}, {"criteria": "cpe:2.3:h:f5:firepass:5.4.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E646309D-AAF0-48D7-B8FF-A57DFAADCF05"}, {"criteria": "cpe:2.3:h:f5:firepass:5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "186F19A2-C1F4-4D87-828B-6825B89F9C9D"}, {"criteria": "cpe:2.3:h:f5:firepass:5.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48D051A9-891E-4C1F-904C-058B37F95441"}, {"criteria": "cpe:2.3:h:f5:firepass:5.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4982DC66-27A6-4A23-A8C7-CF3CC4A5F2BF"}, {"criteria": "cpe:2.3:h:f5:firepass:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BDC49A3-D95D-4DDA-AAFD-4C58C7BA5042"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}