-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2009.0107                  AUSCERT Advisory

                                [Appliance]
           F5 Networks - BigIP 10.0.0 - Multiple Vulnerabilities
                               30 April 2009
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              BIG-IP 10.0.0
Operating System:     Network Appliance
Impact:               Execute Arbitrary Code/Commands
                      Increased Privileges
                      Denial of Service
                      Access Confidential Data
                      Provide Misleading Information
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-2476 CVE-2008-5077 CVE-2009-0040
                      CVE-2009-0583 CVE-2009-0584
Member content until: Thursday, May 28 2009

Ref:                  ESB-2009.0009
                      ESB-2009.0199
                      ESB-2009.0259

OVERVIEW

        F5 Networks have released a hotfix for version 10.0.0 of their 
        BIG-IP range of systems correcting multiple vulnerabilities.


IMPACT

        The vulnerabilities that have been corrected in this release include
        some product specific and external dependencies. The severity of
        impacts vary from executing arbitrary code, crashes and possibly 
        man-in-the-middle attacks.


DETAILS

        CR111056: IPv6 vulnerability VU#472363/CVE-2008-2476

           "The IPv6 Neighbor Discovery Protocol (NDP) implementation in
           [some products] does not validate the origin of Neighbor Discovery
           messages, which allows remote attackers to cause a denial of service
           (loss of connectivity) or read private network traffic via a spoofed
           message that modifies the Forward Information Base (FIB)." [2]
            
        CR114792: OpenSSL vulnerability CVE-2008-5077

            "OpenSSL 0.9.8i and earlier does not properly check the return 
            value from the EVP_VerifyFinal function, which allows remote 
            attackers to bypass validation of the certificate chain via a
            malformed SSL/TLS signature for DSA and ECDSA keys." [3]

        CR116519: Non-admin users can no longer execute privileged CLI or GUI
                  commands

             
        CR117746: libpng vulnerability CVE-2009-0040

            "The PNG reference library (aka libpng) before 1.0.43, and 1.2.x 
            before 1.2.35, allows context-dependent attackers to cause a 
            denial of service (application crash) or possibly execute 
            arbitrary code via a crafted PNG file.[4]

        CR118548: icclib vulnerabilities CVE-2009-0583, and CVE-2009-0584

            Multiple integer overflows in icc.c in the International Color
            Consortium (ICC) Format library (aka icclib), allow 
            context-dependent attackers to cause a denial of service 
            (heap-based buffer overflow and application crash) or possibly
            execute arbitrary code. [5][6]


MITIGATION

        It is recommended to apply hotfix 2 to your devices running BIG-IP
        10.0.0. To download the appropriate software you can visit:

           https://downloads.f5.com/esd/productlines.jsp


REFERENCES

        [1] Release Notes
            https://downloads.f5.com/esd/releaseNotes.jsp

        [2] CVE-2008-2476
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2476

        [3] CVE-2008-5077
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5077

        [4] CVE-2009-0040
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040

        [5] CVE-2009-0583
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0583

        [6] CVE-2009-0584
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0584

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: https://www.auscert.org.au/1967

iD8DBQFJ+QNUNVH5XJJInbgRAm60AKCCjGsm9svUrTrXSfasNRTIaty6HQCeJhVZ
jzvsPUjZJsTywph8wa/CMMM=
=TRJ1
-----END PGP SIGNATURE-----