Barracuda Networks Spam Firewall Multiple Vulnerabilities

Bugtraq ID:	19276
Class:	Unknown
CVE:	CVE-2006-4000 CVE-2006-4001 CVE-2006-4081
Remote:	Yes
Local:	No
Published:	Aug 01 2006 12:00AM
Updated:	Jul 06 2016 12:19PM
Credit:	Greg Sinclair has been credited with the discovery of these vulnerabilities.
Vulnerable:	Barracuda Networks Barracuda Spam Firewall 3.3.03.055 Barracuda Networks Barracuda Spam Firewall 3.3.03.053 Barracuda Networks Barracuda Spam Firewall 3.3.01.001
Not Vulnerable:

Barracuda Networks Spam Firewall Multiple Vulnerabilities

Spam Firewall is prone to multiple vulnerabilities, including a directory-traversal issue, access-validation issue, and a remote command-execution issue.

A remote attacker can exploit these issues to gain access to potentially sensitive information and execute commands in the context of the affected application.

Versions 3.3.01.001 to 3.3.03.055 are vulnerable to these issues.

Barracuda Networks Spam Firewall Multiple Vulnerabilities

Attackers can exploit these issues via a web client.

The following proof-of-concept URI is available.

• /data/vulnerabilities/exploits/BarracudaDirectoryTraversalVulnerabilityAugust12006.html
• /data/vulnerabilities/exploits/BarracudaRemoteCommandAugust032006.html
• /data/vulnerabilities/exploits/BarracudaSpamFireWallExploitAugust082006.pl

Barracuda Networks Spam Firewall Multiple Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Barracuda Networks Spam Firewall Multiple Vulnerabilities

References:

• Barracuda Networks Spam Firewall Home Page (Barracuda Networks)
  
• Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01] (Full Disclosure )
  
• Barracuda Spam Firewall: Administrator Level Remote Command Execution (Matthew Hall)
  
• Re: Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02] (Matthew Hall)