PT-2015-6646
CVE-2015-4637
·
تاريخ النشر
2015-07-16
·
تاريخ التحديث
2015-07-21
الوصف من
CVSS 2.0
4.3
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
F5 BIG-IQ Cloud, Device, and Security versions 4.4.0 through 4.5.0 before HF2
F5 BIG-IQ ADC versions 4.5.0 before HF2
Description
The issue concerns the REST API when configured for LDAP remote authentication. If the LDAP server allows anonymous BIND operations, remote attackers can obtain an authentication token for arbitrary users by guessing an LDAP user account name.
Recommendations
For F5 BIG-IQ Cloud, Device, and Security versions 4.4.0 through 4.5.0 before HF2, apply HF2 to resolve the issue.
For F5 BIG-IQ ADC versions 4.5.0 before HF2, apply HF2 to resolve the issue.
As a temporary workaround, consider restricting anonymous BIND operations on the LDAP server until the issue is resolved.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾