PT-2007-5435 · Astaro · Astaro Security Gateway

Published 2007-08-08 · Updated 2018-10-15 · CVE-2007-4242

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Astaro Security Gateway (ASG) version 7

Description The issue concerns the pop3 Proxy in Astaro Security Gateway, which fails to perform virus scanning on attachments that exceed the maximum allowed size. As a result, these attachments are passed through without scanning, allowing remote attackers to bypass the virus scanning by sending a large attachment.

Recommendations For Astaro Security Gateway (ASG) version 7, consider configuring the system to handle large attachments differently, such as by blocking or quarantining them, until a proper fix is available. As a temporary workaround, restrict the maximum attachment size to prevent bypassing of the virus scanning.

Fix

Related Identifiers

CVE-2007-4242

Affected Products

Astaro Security Gateway

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4242 · Security Note
• http://hescominsoon.com/archives/773 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4242 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35827 · Note
• http://securityfocus.com/archive/1/475642/100/0/threaded · Note
• http://securityfocus.com/archive/1/477120/100/0/threaded · Note
• http://securitytracker.com/id?1018543 · Note
• http://securityreason.com/securityalert/2981 · Note