Multiple Barracuda Products Multiple Input Validation Vulnerabilities
BID:32867
Info
Multiple Barracuda Products Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 32867 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0971 CVE-2008-1094 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2008 12:00AM |
| Updated: | Dec 19 2008 06:42PM |
| Credit: | Dr. Marian Ventuneac |
| Vulnerable: |
Barracuda Web Filter 3.3.0.038 Barracuda Spam Firewall 3.5.11.020 Barracuda Message Archiver 1.1.0.010 Barracuda Load Balancer 2.2.6 Barracuda IM Firewall 3.0.01.008 |
| Not Vulnerable: |
Barracuda Web Filter 3.3.0.052 Barracuda Spam Firewall 3.5.12.007 Barracuda Message Archiver 1.2.1.002 Barracuda Load Balancer 2.3.24 Barracuda IM Firewall 3.1.01.017 |
Discussion
Multiple Barracuda Products Multiple Input Validation Vulnerabilities
Multiple Barracuda products are prone to multiple input-validation vulnerabilities, including multiple cross-site scripting vulnerabilities, an HTML-injection vulnerability, and an SQL-injection vulnerability.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to the following are affected:
Barracuda Message Archiver to 1.2.1.002.
Barracuda Spam Firewall 3.5.12.007 and prior
Barracuda Web Filter 3.3.0.052 and prior
Barracuda IM Firewall 3.1.01.017 and prior
Barracuda Load Balancer 2.3.024 and prior
Multiple Barracuda products are prone to multiple input-validation vulnerabilities, including multiple cross-site scripting vulnerabilities, an HTML-injection vulnerability, and an SQL-injection vulnerability.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to the following are affected:
Barracuda Message Archiver to 1.2.1.002.
Barracuda Spam Firewall 3.5.12.007 and prior
Barracuda Web Filter 3.3.0.052 and prior
Barracuda IM Firewall 3.1.01.017 and prior
Barracuda Load Balancer 2.3.024 and prior
Exploit / POC
Multiple Barracuda Products Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
Multiple Barracuda Products Multiple Input Validation Vulnerabilities
Solution:
The vendor released an update to address these issues. Please see the references for more information.
Solution:
The vendor released an update to address these issues. Please see the references for more information.
References
Multiple Barracuda Products Multiple Input Validation Vulnerabilities
References:
References:
- Barracuda Networks Products - Multiple Cross-Site Scripting Vulnerabilities (Dr. Marian Ventuneac)
- Barracuda Networks Products - SQL Injection Vulnerability (Dr. Marian Ventuneac)
- Resolved input field validation and HTML encoding issues in select Barracuda Net (Barracuda Networks)
- Vendor Homepage (Barracuda Networks)
- CVE-2008-0971 - Barracuda Networks products Multiple Cross-Site Scripting Vulner ([email protected])
- CVE-2008-1094 - Barracuda Span Firewall SQL Injection Vulnerability ([email protected])