PT-2009-4731 · Phion · Phion Airlock Web Application Firewall

Published 2009-07-02 · Updated 2018-10-10 · CVE-2009-2300

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions phion airlock Web Application Firewall (WAF) versions 4.1 through 10.41

Description The management interface in the phion airlock Web Application Firewall (WAF) does not properly handle CGI requests with large width and height parameters for an image. This allows remote attackers to execute arbitrary commands or cause a denial of service due to resource consumption via a crafted request.

Recommendations For versions 4.1 through 10.41, consider restricting access to the management interface to minimize the risk of exploitation. As a temporary workaround, avoid using the width and height parameters in image requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-2300

Affected Products

Phion Airlock Web Application Firewall

References · 5

• https://techzone.phion.com/hotfix_HF4112 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2300 · Security Note
• http://secunia.com/advisories/35641 · Note
• http://securityfocus.com/archive/1/504681/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2300 · Note