CVE-2015-4637

Name of the Vulnerable Software and Affected Versions F5 BIG-IQ Cloud, Device, and Security versions 4.4.0 through 4.5.0 before HF2 F5 BIG-IQ ADC versions 4.5.0 before HF2

Description The issue concerns the REST API when configured for LDAP remote authentication. If the LDAP server allows anonymous BIND operations, remote attackers can obtain an authentication token for arbitrary users by guessing an LDAP user account name.

Recommendations For F5 BIG-IQ Cloud, Device, and Security versions 4.4.0 through 4.5.0 before HF2, apply HF2 to resolve the issue. For F5 BIG-IQ ADC versions 4.5.0 before HF2, apply HF2 to resolve the issue. As a temporary workaround, consider restricting anonymous BIND operations on the LDAP server until the issue is resolved.