Barracuda Networks Spam & Virus Firewall 'view_help.cgi' Directory Traversal Vulnerability

Bugtraq ID:	43520
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 27 2010 12:00AM
Updated:	Sep 27 2010 12:00AM
Credit:	ShadowHatesYou
Vulnerable:	Barracuda Spam & Virus Firewall 4.1.1.021
Not Vulnerable:

Barracuda Networks Spam & Virus Firewall 'view_help.cgi' Directory Traversal Vulnerability

Barracuda Networks Spam & Virus Firewall is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

A remote attacker can exploit this vulnerability using directory-traversal characters ('../') to access files that contain sensitive information that can aid in further attacks.

Spam & Virus Firewall 4.1.1.021 is vulnerable; other versions may also be affected.

Barracuda Networks Spam & Virus Firewall 'view_help.cgi' Directory Traversal Vulnerability

An attacker can exploit this issue via a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/43520.sh

Barracuda Networks Spam & Virus Firewall 'view_help.cgi' Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Barracuda Networks Spam & Virus Firewall 'view_help.cgi' Directory Traversal Vulnerability

References:

• Vendor Homepage (Barracuda Networks)