Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT Security Bulletin ASB-2012.0160 A Cross-Site Scripting (XSS) vulnerability exists in the BIG-IP ASM Web Scraping feature 19 November 2012 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: BIG-IP ASM Operating System: Network Appliance Impact/Access: Cross-site Scripting -- Remote with User Interaction Resolution: Patch/Upgrade Member content until: Wednesday, December 19 2012 OVERVIEW A cross-site scripting vulnerability has been fixed in the BIG-IP ASM web scraping feature. IMPACT The following information is from the F5 website: "A cross-site scripting (XSS) vulnerability exists when the BIG-IP ASM Web Scraping feature is set to Block in the ASM security policy. The vulnerability may allow client browsers to execute actions which are not part of the web application." [1] Versions 10.1.0 - 10.2.2 are affected. [1] MITIGATION Hotfix-BIGIP-10.2.2-852.0-HF1 has been released for version 10.2.2 only but there is also a workaround. [1] REFERENCES [1] SOL12953: A Cross-Site Scripting (XSS) vulnerability exists in the BIG-IP ASM Web Scraping feature http://support.f5.com/kb/en-us/solutions/public/12000/900/sol12953.html?ref=rss AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUKmUn+4yVqjM2NGpAQKTLQ/9HzBkiM0pqWGbLuKqVWYVQmVx/poFFQuo p7jKB1gc80XScUBxZV5R5hkz9F6r/vHumIWw8OX2gVhrE0nPEKDlemHLo2mGXGzD wh9cMroMVuZDFCnaNt1TcAR/dR6DpotmkSr1lp6c5Fq7MQwBvpxGl7ir+gkuTOcC NgI6YDoxRgxUjRnGzH9sIKQAMYI5RFuD0nO07NWnR6UwJ+PG9/SEGDB4Irvg27/I D/bgXRgJDa2nh9yhRKD6qRD+y8aQaZ82IynTHMbY5WCNLr9yYA9S4s/9eYp4OD4X N3d5dj1iHsSJ/YkVhHSab/4p/sPYWBoGwYqBBjP9qUz1MsnPKSCzrTsHYGk32Uax fSHDkt15pl1nDEHRqRoFR6Beg+J+z8CmnQNNnPightt520yTW3evwu0b6V8xYToi egrvMILoEhqb+HXSdpO5bWBn3BQhKrHK1GmahkY/qjJOIN+TbFWsHBMPpAyyga18 MWVH3r2g1h1y1gP3ZXQowe/xGScyPGoKuSeONrFdvoQbjzcnoZAZV+XL2ZFtO2Ji A5pENuhyeAy/V5nnQPMxxzBXYv8f8LvEw9TM6uP1Qdruwulb7SQq20XLfPLQbkVw g6msW38BcSTSfWb91uhIDxqYSKjb/Zk0iejxXFqJcedoovaca9PZ1MgNDEluA9vP 1g6Z9YFZgZI= =KP4T -----END PGP SIGNATURE-----