CVE-2012-1493

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 63%

from disclosure to weapon0 days

Published on NVDJul 9

1st PoCJun 11

metasploitJun 11

exploitation probability

63%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/19064unverified exploitdbwww.exploit-db.com/exploits/19091unverified exploitdbwww.exploit-db.com/exploits/19099unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html https://www.trustmatta.com/advisories/MATTA-2012-002.txt http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/