-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0160
         A Cross-Site Scripting (XSS) vulnerability exists in the
                      BIG-IP ASM Web Scraping feature
                             19 November 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              BIG-IP ASM
Operating System:     Network Appliance
Impact/Access:        Cross-site Scripting -- Remote with User Interaction
Resolution:           Patch/Upgrade
Member content until: Wednesday, December 19 2012

OVERVIEW

        A cross-site scripting vulnerability has been fixed in the BIG-IP ASM
        web scraping feature.


IMPACT

        The following information is from the F5 website:
        "A cross-site scripting (XSS) vulnerability exists when the BIG-IP ASM
        Web Scraping feature is set to Block in the ASM security policy. The
        vulnerability may allow client browsers to execute actions which are
        not part of the web application." [1]
        
        Versions 10.1.0 - 10.2.2 are affected. [1]


MITIGATION

        Hotfix-BIGIP-10.2.2-852.0-HF1 has been released for version 10.2.2
        only but there is also a workaround. [1]


REFERENCES

        [1] SOL12953: A Cross-Site Scripting (XSS) vulnerability exists in the
            BIG-IP ASM Web Scraping feature
            http://support.f5.com/kb/en-us/solutions/public/12000/900/sol12953.html?ref=rss

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUKmUn+4yVqjM2NGpAQKTLQ/9HzBkiM0pqWGbLuKqVWYVQmVx/poFFQuo
p7jKB1gc80XScUBxZV5R5hkz9F6r/vHumIWw8OX2gVhrE0nPEKDlemHLo2mGXGzD
wh9cMroMVuZDFCnaNt1TcAR/dR6DpotmkSr1lp6c5Fq7MQwBvpxGl7ir+gkuTOcC
NgI6YDoxRgxUjRnGzH9sIKQAMYI5RFuD0nO07NWnR6UwJ+PG9/SEGDB4Irvg27/I
D/bgXRgJDa2nh9yhRKD6qRD+y8aQaZ82IynTHMbY5WCNLr9yYA9S4s/9eYp4OD4X
N3d5dj1iHsSJ/YkVhHSab/4p/sPYWBoGwYqBBjP9qUz1MsnPKSCzrTsHYGk32Uax
fSHDkt15pl1nDEHRqRoFR6Beg+J+z8CmnQNNnPightt520yTW3evwu0b6V8xYToi
egrvMILoEhqb+HXSdpO5bWBn3BQhKrHK1GmahkY/qjJOIN+TbFWsHBMPpAyyga18
MWVH3r2g1h1y1gP3ZXQowe/xGScyPGoKuSeONrFdvoQbjzcnoZAZV+XL2ZFtO2Ji
A5pENuhyeAy/V5nnQPMxxzBXYv8f8LvEw9TM6uP1Qdruwulb7SQq20XLfPLQbkVw
g6msW38BcSTSfWb91uhIDxqYSKjb/Zk0iejxXFqJcedoovaca9PZ1MgNDEluA9vP
1g6Z9YFZgZI=
=KP4T
-----END PGP SIGNATURE-----