PT-2007-6161 · Barracuda · Barracuda Spam Firewall

Published 2007-09-24 · Updated 2018-10-15 · CVE-2007-5058

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barracuda Spam Firewall versions prior to 3.5.10.016

Description The issue is related to a cross-site scripting (XSS) vulnerability in the Web administration interface. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the username field in a login attempt. The vulnerability is triggered when the Monitor Web Syslog screen is open and the input is not properly handled.

Recommendations For versions prior to 3.5.10.016, update to firmware version 3.5.10.016 or later to resolve the issue. As a temporary workaround, consider restricting access to the Web administration interface and avoiding the use of the username field in login attempts when the Monitor Web Syslog screen is open.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5058

Affected Products

Barracuda Spam Firewall

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-5058 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5058 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36716 · Note
• http://vupen.com/english/advisories/2007/3257 · Note
• http://infobyte.com.ar/adv/ISR-15.html · Note
• http://securityreason.com/securityalert/3164 · Note
• http://barracudanetworks.com/ns/support/tech_alert.php · Note
• http://osvdb.org/38156 · Note
• http://secunia.com/advisories/26937 · Note
• http://securityfocus.com/bid/25757 · Note
• http://securityfocus.com/archive/1/480238/100/0/threaded · Note
• http://securitytracker.com/id?1018733 · Note