BarracudaDrive Web Server Denial of Service and Multiple Input Validation Vulnerabilities
BID:26805
Info
BarracudaDrive Web Server Denial of Service and Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 26805 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6314 CVE-2007-6315 CVE-2007-6316 CVE-2007-6317 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 10 2007 12:00AM |
| Updated: | Jan 03 2008 02:10PM |
| Credit: | Luigi Auriemma is credited with discovering these issues. |
| Vulnerable: |
Real Time Logic BarracudaDrive Web Server Home Server 3.7.2 Real Time Logic BarracudaDrive Web Server 3.7.2 |
| Not Vulnerable: |
Real Time Logic BarracudaDrive Web Server Home Server 3.8 Real Time Logic BarracudaDrive Web Server 3.8 |
Discussion
BarracudaDrive Web Server Denial of Service and Multiple Input Validation Vulnerabilities
BarracudaDrive Web Server is prone to a denial-of-service vulnerability and multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues can allow an attacker to retrieve, view, or delete arbitrary files; inject hostile HTML or script code in the context of the application running the vulnerable software; or crash the webserver, denying service to legitimate users.
BarracudaDrive Web Server is prone to a denial-of-service vulnerability and multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these issues can allow an attacker to retrieve, view, or delete arbitrary files; inject hostile HTML or script code in the context of the application running the vulnerable software; or crash the webserver, denying service to legitimate users.
Exploit / POC
BarracudaDrive Web Server Denial of Service and Multiple Input Validation Vulnerabilities
Attackers can exploit these issues via a browser.
The following proof-of-concept URIs are available:
Attackers can exploit these issues via a browser.
The following proof-of-concept URIs are available:
Solution / Fix
BarracudaDrive Web Server Denial of Service and Multiple Input Validation Vulnerabilities
Solution:
BarracudaDrive Web Server 3.8 has been released to address these issues. Please contact the vendor for information on obtaining and applying this release.
Real Time Logic BarracudaDrive Web Server Home Server 3.7.2
Real Time Logic BarracudaDrive Web Server 3.7.2
Solution:
BarracudaDrive Web Server 3.8 has been released to address these issues. Please contact the vendor for information on obtaining and applying this release.
Real Time Logic BarracudaDrive Web Server Home Server 3.7.2
-
Real Time Logic bdinstall.exe
http://barracudaserver.com/products/BarracudaDrive/bdinstall.exe
Real Time Logic BarracudaDrive Web Server 3.7.2
-
Real Time Logic bdinstall.exe
http://barracudaserver.com/products/BarracudaDrive/bdinstall.exe
References
BarracudaDrive Web Server Denial of Service and Multiple Input Validation Vulnerabilities
References:
References:
- BarracudaDrive Web Server Homepage (Real Time Logic)
- Multiple vulnerabilities in BarracudaDrive 3.7.2 (Luigi Auriemma