PT-2006-4925 · Barracuda · Barracuda Spam Firewall

Greg Sinclair + 1 · Publicado 2006-08-11 · Atualizado 2018-10-17 · CVE-2006-4081

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Barracuda Spam Firewall (BSF) versions 3.3.01.001 through 3.3.03.053

Description The issue allows remote attackers to execute commands via shell metacharacters, specifically the "|" pipe symbol, in the file parameter of the preview email.cgi script. This can potentially be extended to execute arbitrary commands.

Recommendations For versions 3.3.01.001 through 3.3.03.053, consider restricting access to the preview email.cgi script until a fix is available, and avoid using the "|" pipe symbol in the file parameter to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-4081

Produtos afetados

Barracuda Spam Firewall

Referências · 11

• 🔥 https://exploit-db.com/exploits/2136 · Exploit
• 🔥 https://exploit-db.com/exploits/2145 · Exploit
• http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0110.html · Nota
• http://securityfocus.com/bid/19276 · Nota
• http://securityreason.com/securityalert/1363 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4081 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28234 · Nota
• http://securityfocus.com/archive/1/442132/100/0/threaded · Nota
• http://securityfocus.com/archive/1/442249/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4081 · Nota de Segurança
• http://secunia.com/advisories/21258 · Nota