Barracuda Spam Firewall IMG.PL Remote Directory Traversal Vulnerability

Bugtraq ID:	14710
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 01 2005 12:00AM
Updated:	Sep 01 2005 12:00AM
Credit:	Discovery is credited to Francois Harvey <[email protected]>.
Vulnerable:	Barracuda Barracuda Spam Firewall 3.1.17 firmware
Not Vulnerable:	Barracuda Barracuda Spam Firewall 3.1.18 firmware

Barracuda Spam Firewall IMG.PL Remote Directory Traversal Vulnerability

Barracuda Spam Firewall is prone to a directory traversal vulnerability. This issue affects the Web interface of the appliance.

Exploitation of this vulnerability could lead to a loss of confidentiality as arbitrary files are disclosed to an attacker. Information obtained through this attack may aid in further attacks against the underlying system.

Barracuda Spam Firewall firmware 3.1.17 and prior versions are affected by this issue.

Barracuda Spam Firewall IMG.PL Remote Directory Traversal Vulnerability

An exploit is not required.

The following proof of concept is available:

f=../etc/passwd

Barracuda Spam Firewall IMG.PL Remote Directory Traversal Vulnerability

Solution:
The vendor has released firmware version 3.1.18 to address this and other issues. Please contact the vendor to obtain the upgrade.

Barracuda Spam Firewall IMG.PL Remote Directory Traversal Vulnerability

References:

• Barracuda Spam Firewall Product Page (Barracuda Networks)
  
• [SecuriWeb.2005.1] - Barracuda SPAM firewall advisory (Francois Harvey )