PT-2005-3715 · Barracuda · Barracuda Spam Firewall

Francois Harvey · Published 2005-09-08 · Updated 2016-10-18 · CVE-2005-2849

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barracuda Spam Firewall versions 3.1.16 through 3.1.17

Description The issue allows remote attackers to read portions of source code via the -f option to dig device.cgi, determine file existence via the -r argument to tcpdump device.cgi, or modify files in the cgi-bin directory via the -w argument to tcpdump device.cgi.

Recommendations For versions 3.1.16 and 3.1.17, consider restricting access to the dig device.cgi and tcpdump device.cgi scripts until a patch is available. As a temporary workaround, avoid using the -f option with dig device.cgi, the -r argument with tcpdump device.cgi, and the -w argument with tcpdump device.cgi to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-2849

Affected Products

Barracuda Spam Firewall

References · 6

• http://securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2849 · Security Note
• http://securitytracker.com/alerts/2005/Sep/1014837.html · Vendor Advisory
• http://secunia.com/advisories/16683 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=112560044813390&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2849 · Note