PT-2008-2703 · Akamai · Akamai Client

Dyon Balding · Published 2008-06-09 · Updated 2018-10-11 · CVE-2008-1106

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Akamai Client versions 3322 and earlier

Description The issue allows remote attackers to bypass authentication in the management interface via an HTTP request that contains either no Referer header or a spoofed Referer header that matches an approved domain. This enables remote attackers to conduct cross-site request forgery (CSRF) attacks, forcing the client to download and execute arbitrary files.

Recommendations For versions 3322 and earlier, consider implementing authentication checks that verify the Referer header to ensure it matches an approved domain, and validate the authenticity of requests to prevent CSRF attacks. As a temporary workaround, restrict access to the management interface to minimize the risk of exploitation.

Fix

CSRF

Improper Authentication

Weakness Enumeration

CWE-352

CWE-287

Related Identifiers

CVE-2008-1106

Affected Products

Akamai Client

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2008-1106 · Security Note
• http://secunia.com/secunia_research/2008-19/advisory · Vendor Advisory
• http://secunia.com/advisories/30135 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1106 · Note
• http://securityreason.com/securityalert/3930 · Note
• http://securityfocus.com/archive/1/493170/100/0/threaded · Note
• http://vupen.com/english/advisories/2008/1761/references · Note
• http://securitytracker.com/id?1020208 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42895 · Note
• http://securityfocus.com/archive/1/493169/100/0/threaded · Note