-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0076
      A vulnerability has been identified in sudo as used by FirePass
                                23 May 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              FirePass
Operating System:     Network Appliance
Impact/Access:        Root Compromise -- Existing Account
Resolution:           Mitigation
CVE Names:            CVE-2012-2053  
Member content until: Friday, June 22 2012

Comment: At present the vendor has not released any hotfixes or new versions 
         to correct this vulnerability. It is advised that administrators 
         ensure that only intended authorised individuals are allowed access 
         to the underlying operating system.

OVERVIEW

        A possible sudo vulnerability has been identified in FirePass versions
        6.0.0 through 6.1.0 and 7.0.0.


IMPACT

        The vendor has provided the following details regarding this 
        vulnerability:
        
        "FirePass does not require a password to execute sudo commands with 
        elevated permissions. FirePass is designed to function as a closed-box 
        appliance with no user-level access to the underlying operating system. 
        A successful attack would require an attacker to gain access to the 
        operating system prior to executing any command with elevated 
        privileges.
        
        An attacker may be able to exploit the vulnerability and execute system 
        level commands if access is first gained to the underlying operating 
        system." [1]


MITIGATION

        At present the vendor has not released any hotfixes or new versions
        to correct this vulnerability. It is advised that administrators
        ensure that only intended authorised individuals are allowed access to 
        the underlying operating system.


REFERENCES

        [1] sol13605: FirePass sudo vulnerability - CVE-2012-2053
            http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13605.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT7xgl+4yVqjM2NGpAQLtGQ/9Hta2meT6pjdFIK4oVE6PFdMCql+DSa7M
oRWUzuvX54+JQbs2IiOFBCuer0z8VuEuUY+lLwlBmA/X6VWv1QsbKGQZFJ7clD3j
C3N3mdUdmojBge/3IxwV6/WlttDTuavUbsMe7BFs7uF1FEmPguWtT87c8a03yZrW
5fbBGnj69BIbn1152jXslp9TA6AZZpZ2eC+jc6C4NUdiJl+yiU8JEKHEelXmF1hJ
rtD+K8wTUVTqs78t3cb6JjB9O+1JjtJ8Tqv6MZbmhCiALbVEW6mUan1jgSEUFJsb
XxIPERmSIWsRg/lLayliOo56nmahaf0BRYpBZUIwGixiQnSHrDmyu/JfgAYt9kuy
Es9BhGG5yatPqx2tmOL7uus/nf3xnO3aBYTd+WSLkBhsSfs7tNIav4Ovkc3lAMVG
ti1OaVlSkFoknIFXh8dDitzBzwPVrO+TEyY7mIZ7HBce75jkEU18MY2fj+M07v5b
jpiQETr85hkWtqBAWSrVsg+RF4wamt8dz3SPFdxGeNCiUQwLHIkMYzm5IxtceA+w
r7Jkbhd2SiIE1hiAhTZQa+/xA0BMPPynPPqpbIIdSoWsI7xlZgDeEDCUhbsQFq2/
cZUGBE/0PzWTX8xxAvGllBn0Y8vsp6B6OG7DB38ocXMTiSYWw7JIbCCRIlfq4YTI
Vq2qw2SxYqM=
=C1tt
-----END PGP SIGNATURE-----