正文

barracuda_im_firewall,barracuda_message_archiver,barracuda_spam_firewall,barracuda_web_filter,barracuda_load_balancer 跨站脚本漏洞

admin
admin V管理员 /0 评论 /10 阅读
0415
此篇文章发布距今已超过1171天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2008-0971

利用情况

暂无

补丁情况

N/A

披露时间

2008-12-20
漏洞描述
Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web Filter before 3.3.0.052, IM Firewall before 3.1.01.017, and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration, (3) Administration, (4) Journal Accounts, (5) Retention Policy, and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall, (b) IM Firewall, and (c) Web Filter.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
http://dcsl.ul.ie/advisories/03.htm
http://secunia.com/advisories/33164
http://securityreason.com/securityalert/4792
http://securitytracker.com/id?1021454
http://www.barracudanetworks.com/ns/support/tech_alert.php
http://www.osvdb.org/50709
http://www.securityfocus.com/archive/1/499294/100/0/threaded
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
硬件 barracuda_networks barracuda_im_firewall * Up to
(including)
3.0.01.008
运行在以下环境
硬件 barracuda_networks barracuda_load_balancer * Up to
(including)
2.2.006
运行在以下环境
硬件 barracuda_networks barracuda_message_archiver * Up to
(including)
1.1.0.010
运行在以下环境
硬件 barracuda_networks barracuda_spam_firewall * Up to
(including)
3.5.11.020
运行在以下环境
硬件 barracuda_networks barracuda_web_filter * Up to
(including)
3.3.0.038
CVSS3评分 3.5
  • 攻击路径 网络
  • 攻击复杂度 N/A
  • 权限要求 一次
  • 影响范围 N/A
  • 用户交互 无
  • 可用性 无
  • 保密性 无
  • 完整性 部分地
AV:N/AC:M/Au:S/C:N/I:P/A:N CWE-ID 漏洞类型 CWE-79 在Web页面生成时对输入的转义处理不恰当（跨站脚本）