Exploit posted for vulnerable F5 kit

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/

By Richard Chirgwin
The Register
13th June 2012

A vulnerability in F5 kit first announced in February may be in the 
wild, with code posted to Github purporting to be an exploit.

The original advisory stated that vulnerable installations of F5’s BigIP 
and other systems allowed an attacker to log in as root, because the 
vulnerability exposed the device’s SSH private key. F5 responded earlier 
this month.

Since it’s only seven days since F5 issued its advisory – and the patch 
– it’s likely that unpatched systems still exist.

F5 describes the issue as “A platform-specific remote access 
vulnerability has been discovered that may allow a remote user to gain 
privileged access to affected systems using SSH. The vulnerability is 
caused by a configuration error, and is not the result of an underlying 
SSH defect.”

[...]

--
Certified Ethical Hacker, ISSMP, ISSAP, CISSP training
with Expanding Security gives the best training and support.
Get a free live class invite weekly. Best programs, best prices.
http://www.ExpandingSecurity.com/PainPill