Info

Disclosure

Apr 25, 2005

Discovery

Sep 10, 2004

Dates

Exploit

Sep 22, 2004

Solution

Unknown

Description

F5 Big-IP and 3DNS contain a flaw that may allow a malicious user to bypass RADIUS authentication. The issue is triggered when an attacker sends a specially-crafted RADIUS ACCEPT packet response, with the origin set as the radius server, and the login_radius function fails to properly check the shared secret, resulting in a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Authentication Management
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified

Solution

Upgrade to version 3DNS 4.5.11 or higher and Big-IP 4.6.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

F5 Networks, Inc.	3DNS	4.2
		4.3
		4.4
		4.5
		4.5.1
		4.5.2
		4.5.3
		4.5.4
		4.5.5
		4.5.6
		4.5.7
		4.5.8
		4.5.9
		4.5.10
		4.5.11
	BIG-IP	4.6
		4.6.1
		4.6.2
		4.6.3

References

Related OSVDB ID: 10203
Bugtraq ID: 11227
Secunia Advisory ID: 12617 15098
ISS X-Force ID: 20237
Vendor Specific Advisory URL: http://tech.f5.com/home/bigip/solutions/advisories/sol3456.html
Vendor URL: http://www.f5.com/f5products/products/bigip/index.html

Credit

Eilko Bos - E.Bosreseau.nl - Le Reseau B.V.

Direct URL: http://osvdb.org/36218

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

F5 Networks, Inc.

3DNS

BIG-IP

References

Credit