F5 Networks rsync RCE

high Nessus Plugin ID 78427

Language:

Synopsis

The remote host is running a rsync daemon that allows a user to upload arbitrary files.

Description

The rsync daemon on the remote F5 Networks host is affected by an authentication bypass vulnerability when configured in failover mode.
An unauthenticated, remote attacker can exploit this, via a cmi request to the ConfigSync IP address, to read or write arbitrary files.

Nessus was able to confirm that a module on the remote rsync daemon allows writing files to the root of the file system. An attacker can overwrite '/root/.ssh/authorized_keys' and obtain ssh access, allowing the execution of arbitrary code with the privileges of the root user.

Solution

Disable the rsync daemon.

Plugin Details

Severity: High

ID: 78427

File Name: f5_rsync_rce.nasl

Version: 1.5

Type: remote

Family: Misc.

Published: 10/14/2014

Updated: 7/11/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/h:f5:big-ip

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 8/28/2014

Vulnerability Publication Date: 8/28/2014

Reference Information

CVE: CVE-2014-2927

BID: 69461

Detections

Analytics