PT-2007-6161 · Barracuda · Barracuda Spam Firewall

Publicado 2007-09-24 · Atualizado 2018-10-15 · CVE-2007-5058

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barracuda Spam Firewall versions prior to 3.5.10.016

Description The issue is related to a cross-site scripting (XSS) vulnerability in the Web administration interface. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the username field in a login attempt. The vulnerability is triggered when the Monitor Web Syslog screen is open and the input is not properly handled.

Recommendations For versions prior to 3.5.10.016, update to firmware version 3.5.10.016 or later to resolve the issue. As a temporary workaround, consider restricting access to the Web administration interface and avoiding the use of the username field in login attempts when the Monitor Web Syslog screen is open.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5058

Produtos afetados

Barracuda Spam Firewall

Referências · 12

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5058 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36716 · Nota
• http://vupen.com/english/advisories/2007/3257 · Nota
• http://infobyte.com.ar/adv/ISR-15.html · Nota
• http://securityreason.com/securityalert/3164 · Nota
• http://barracudanetworks.com/ns/support/tech_alert.php · Nota
• http://osvdb.org/38156 · Nota
• http://secunia.com/advisories/26937 · Nota
• http://securityfocus.com/bid/25757 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5058 · Nota de Segurança
• http://securityfocus.com/archive/1/480238/100/0/threaded · Nota
• http://securitytracker.com/id?1018733 · Nota