PT-2015-4991 · Barracuda · Barracuda Web Filter

Publicado 2015-05-25 · Atualizado 2015-05-27 · CVE-2015-0961

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barracuda Web Filter versions prior to 8.1.0.005

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate when SSL Inspection is enabled, due to the lack of verification of X.509 certificates from upstream SSL servers.

Recommendations For versions prior to 8.1.0.005, update to version 8.1.0.005 or later to resolve the issue. As a temporary workaround, consider disabling SSL Inspection until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2015-0961

Produtos afetados

Barracuda Web Filter

Referências · 5

• http://kb.cert.org/vuls/id/534407 · Nota
• https://techlib.barracuda.com/BWF/UpdateSSLCerts · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-0961 · Nota de Segurança
• https://barracuda.com/support/techalerts · Aviso do Fabricante
• https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature · Aviso do Fabricante