PT-2009-4731 · Phion · Phion Airlock Web Application Firewall

Publicado 2009-07-02 · Atualizado 2018-10-10 · CVE-2009-2300

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions phion airlock Web Application Firewall (WAF) versions 4.1 through 10.41

Description The management interface in the phion airlock Web Application Firewall (WAF) does not properly handle CGI requests with large width and height parameters for an image. This allows remote attackers to execute arbitrary commands or cause a denial of service due to resource consumption via a crafted request.

Recommendations For versions 4.1 through 10.41, consider restricting access to the management interface to minimize the risk of exploitation. As a temporary workaround, avoid using the width and height parameters in image requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-2300

Produtos afetados

Phion Airlock Web Application Firewall

Referências · 5

• http://secunia.com/advisories/35641 · Nota
• http://securityfocus.com/archive/1/504681/100/0/threaded · Nota
• https://techzone.phion.com/hotfix_HF4112 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2300 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2300 · Nota de Segurança