Unscored severity · published Oct 15, 2014
CVE-2014-2927
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and…
–
CVSS
7.9%
EPSS
No
On KEV
Description
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.9% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arx · F5
6.0.0; 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0 · source: NVD
BA
Big-ip Access Policy Manager · F5
10.1.0; 10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; +10 more · source: NVD
BA
Big-ip Advanced Firewall Manager · F5
11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.6.0 · source: NVD
BA
Big-ip Analytics · F5
11.0.0; 11.1.0; 11.2.0; 11.2.1; 11.3.0; 11.4.0; +4 more · source: NVD
BA
Big-ip Application Acceleration Manager · F5
11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.6.0 · source: NVD
BA
Big-ip Application Security Manager · F5
10.0.0; 10.0.1; 10.1.0; 10.2.0; 10.2.1; 10.2.2; +12 more · source: NVD
BE
Big-ip Edge Gateway · F5
10.1.0; 10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; +5 more · source: NVD
BG
Big-ip Global Traffic Manager · F5
10.0.0; 10.0.1; 10.1.0; 10.2.0; 10.2.1; 10.2.2; +12 more · source: NVD
BL
Big-ip Link Controller · F5
10.0.0; 10.0.1; 10.1.0; 10.2.0; 10.2.1; 10.2.2; +12 more · source: NVD
BL
Big-ip Local Traffic Manager · F5
10.0.0; 10.0.1; 10.1.0; 10.2.0; 10.2.1; 10.2.2; +12 more · source: NVD
BP
Big-ip Policy Enforcement Manager · F5
11.3.0; 11.4.0; 11.4.1; 11.5.0; 11.5.1; 11.6.0 · source: NVD
BP
Big-ip Protocol Security Module · F5
10.0.0; 10.0.1; 10.1.0; 10.2.0; 10.2.1; 10.2.2; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2927
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2927
Exploit
http://www.exploit-db.com/exploits/34465
Exploit
http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf
Vendor Advisory
https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html
More from Arx
9.8
CVE-2017-18017
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service…
9.1
CVE-2011-3188
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes…
5.9
CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for…