NVD

Id
31230  
Name
CVE-2014-2927  
Description
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-10-15  
Modified Date
2015-01-26  
Seq
2014-2927  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
163768 31230 CVE-2014-2927 34465  View
163769 31230 CVE-2014-2927 http://www.security-assessment.com/files/documents/advisory/F5_Unauthenticated_rsync_access_to_Remote_Root_Code_Execution.pdf  View
163770 31230 CVE-2014-2927 https://support.f5.com/kb/en-us/solutions/public/15000/200/sol15236.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16173 JVNDB-2014-005048 複数の F5 BIG-IP 製品の rsync デーモンにおける任意のファイルを読まれる脆弱性 複数の F5 BIG-IP 製品の rsync デーモンは、フェールオーバーモードで構成されている場合、認証を要求しないため、任意のファイルを読まれる、または書き込まれる脆弱性が存在します。 CVE-2014-2927 70214 CVE-2014-2927 31230 9.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005048.html 2014-08-28 2014-10-28 View