Barracuda Spam Firewall 'ldap_test.cgi' Cross-Site Scripting Vulnerability
BID:29340
Info
Barracuda Spam Firewall 'ldap_test.cgi' Cross-Site Scripting Vulnerability
| Bugtraq ID: | 29340 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2333 |
| Remote: | Yes |
| Local: | No |
| Published: | May 22 2008 12:00AM |
| Updated: | Mar 19 2015 09:42AM |
| Credit: | Information Risk Management Plc. |
| Vulnerable: |
Barracuda Networks Barracuda Spam Firewall 3.5.11 .020 Barracuda Networks Barracuda Spam Firewall 3.3.15 026 Barracuda Networks Barracuda Spam Firewall 3.1.18 firmware Barracuda Networks Barracuda Spam Firewall 3.1.17 firmware Barracuda Networks Barracuda Spam Firewall 3.3.03.055 Barracuda Networks Barracuda Spam Firewall 3.3.03.053 Barracuda Networks Barracuda Spam Firewall 3.3.03.022 firmware Barracuda Networks Barracuda Spam Firewall 3.3.01.001 Barracuda Networks Barracuda Spam Firewall 3.3.0.54 |
| Not Vulnerable: |
Barracuda Networks Barracuda Spam Firewall 3.5.11 .025 |
Discussion
Barracuda Spam Firewall 'ldap_test.cgi' Cross-Site Scripting Vulnerability
Barracuda Spam Firewall is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Firmware prior to Barracuda Spam Firewall 3.5.11.025 is vulnerable.
Barracuda Spam Firewall is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Firmware prior to Barracuda Spam Firewall 3.5.11.025 is vulnerable.
Exploit / POC
Barracuda Spam Firewall 'ldap_test.cgi' Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
Solution / Fix
Barracuda Spam Firewall 'ldap_test.cgi' Cross-Site Scripting Vulnerability
Solution:
The vendor released firmware 3.5.11.025 to address this issue. Please see the references for more information.
Solution:
The vendor released firmware 3.5.11.025 to address this issue. Please see the references for more information.
References
Barracuda Spam Firewall 'ldap_test.cgi' Cross-Site Scripting Vulnerability
References:
References:
- Barracuda Networks Tech Alerts (Barracuda Networks)
- Barracuda Spam Firewall Product Page (Barracuda Networks)
- IRM Security Advisory : Barracuda Networks Spam Firewall Cross-Site Scripting Vu ("Mark Crowther"