PT-2008-2703 · Akamai · Akamai Client

Dyon Balding · Publicado 2008-06-09 · Atualizado 2018-10-11 · CVE-2008-1106

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Akamai Client versions 3322 and earlier

Description The issue allows remote attackers to bypass authentication in the management interface via an HTTP request that contains either no Referer header or a spoofed Referer header that matches an approved domain. This enables remote attackers to conduct cross-site request forgery (CSRF) attacks, forcing the client to download and execute arbitrary files.

Recommendations For versions 3322 and earlier, consider implementing authentication checks that verify the Referer header to ensure it matches an approved domain, and validate the authenticity of requests to prevent CSRF attacks. As a temporary workaround, restrict access to the management interface to minimize the risk of exploitation.

Correção

CSRF

Improper Authentication

Enumeração de Fraquezas

CWE-352

CWE-287

Identificadores relacionados

CVE-2008-1106

Produtos afetados

Akamai Client

Referências · 10

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1106 · Nota de Segurança
• http://securityreason.com/securityalert/3930 · Nota
• http://securityfocus.com/archive/1/493170/100/0/threaded · Nota
• http://vupen.com/english/advisories/2008/1761/references · Nota
• http://securitytracker.com/id?1020208 · Nota
• http://secunia.com/secunia_research/2008-19/advisory · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42895 · Nota
• http://securityfocus.com/archive/1/493169/100/0/threaded · Nota
• http://secunia.com/advisories/30135 · Aviso do Fabricante