PT-2006-4925 · Barracuda · Barracuda Spam Firewall

Greg Sinclair + 1 · Published 2006-08-11 · Updated 2018-10-17 · CVE-2006-4081

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Barracuda Spam Firewall (BSF) versions 3.3.01.001 through 3.3.03.053

Description The issue allows remote attackers to execute commands via shell metacharacters, specifically the "|" pipe symbol, in the file parameter of the preview email.cgi script. This can potentially be extended to execute arbitrary commands.

Recommendations For versions 3.3.01.001 through 3.3.03.053, consider restricting access to the preview email.cgi script until a fix is available, and avoid using the "|" pipe symbol in the file parameter to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-4081

Affected Products

Barracuda Spam Firewall

References · 11

• 🔥 https://exploit-db.com/exploits/2136 · Exploit
• 🔥 https://exploit-db.com/exploits/2145 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4081 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0110.html · Note
• http://securityfocus.com/bid/19276 · Note
• http://securityreason.com/securityalert/1363 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4081 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28234 · Note
• http://securityfocus.com/archive/1/442132/100/0/threaded · Note
• http://securityfocus.com/archive/1/442249/100/0/threaded · Note
• http://secunia.com/advisories/21258 · Note