PT-2015-4991 · Barracuda · Barracuda Web Filter

Published 2015-05-25 · Updated 2015-05-27 · CVE-2015-0961

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Barracuda Web Filter versions prior to 8.1.0.005

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate when SSL Inspection is enabled, due to the lack of verification of X.509 certificates from upstream SSL servers.

Recommendations For versions prior to 8.1.0.005, update to version 8.1.0.005 or later to resolve the issue. As a temporary workaround, consider disabling SSL Inspection until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2015-0961

Affected Products

Barracuda Web Filter

References · 5

• https://techlib.barracuda.com/BWF/UpdateSSLCerts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0961 · Security Note
• https://barracuda.com/support/techalerts · Vendor Advisory
• https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature · Vendor Advisory
• http://kb.cert.org/vuls/id/534407 · Note