Proofpoint Protection Server Multiple Input Validation Security Vulnerabilities

Bugtraq ID:	47675
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 02 2011 12:00AM
Updated:	May 02 2011 12:00AM
Credit:	Scott Miles of Clear Skies Security.
Vulnerable:	Proofpoint, Inc Proofpoint Protection Server 6.2.0 Proofpoint, Inc Proofpoint Protection Server 6.1.1 Proofpoint, Inc Proofpoint Protection Server 6.0.2 Proofpoint, Inc Proofpoint Protection Server 5.5.5 Proofpoint, Inc Proofpoint Protection Server 5.5.4 Proofpoint, Inc Proofpoint Protection Server 5.5.3
Not Vulnerable:

Proofpoint Protection Server Multiple Input Validation Security Vulnerabilities

Proofpoint Protection Server is prone to the following security vulnerabilities:

1. An authentication-bypass vulnerability
2. A command-injection vulnerability
3. An SQL-injection vulnerability
4. A security-bypass vulnerability
5. A directory-traversal vulnerability

Attackers may exploit these issues to retrieve arbitrary files from the affected application, compromise the application, obtain sensitive information, access or modify data, exploit latent vulnerabilities in the underlying database, and gain administrative access to the affected application.

Proofpoint Protection Server Multiple Input Validation Security Vulnerabilities

Attackers can use a browser to exploit these issues.

Proofpoint Protection Server Multiple Input Validation Security Vulnerabilities

Solution:
Updates are available. Please see the reference for more details.

Proofpoint Protection Server Multiple Input Validation Security Vulnerabilities

References:

• Proofpoint Protection Server Homepage (Proofpoint, Inc)
  
• VU#790980 Proofpoint Protection Server contains multiple vulnerabilities (US-CERT)