PT-2010-1970 · Ibm · Ibm Proventia Network Mail Security System

Publicado 2010-09-14 · Atualizado 2018-10-10 · CVE-2010-0155

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Proventia Network Mail Security System (PNMSS) appliance versions prior to 2.5

Description The issue concerns a CRLF injection vulnerability in the load.php file of the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance. This vulnerability allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the javaVersion parameter.

Recommendations For versions prior to 2.5, update the firmware to version 2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the load.php file in the LMI to minimize the risk of exploitation. Avoid using the javaVersion parameter in the affected interface until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-0155

Produtos afetados

Ibm Proventia Network Mail Security System

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2010-0155 · Nota de Segurança
• http://ventuneac.net/security-advisories/MVSA-10-009 · Nota
• http://securityfocus.com/archive/1/513636/100/0/threaded · Nota