Barracuda dig_device.cgi obtain information

barracuda-digdevice-obtain-information (22121) The risk level is classified as MediumMedium Risk

Description:

Barracuda Spam Firewall could allow a remote attacker to obtain sensitive information caused by a vulnerability in the /cgi-bin/dig_device.cgi file. A remote attacker could send a specially-crafted request to the /cgi-bin/dig_device.cgi file using various flag options to view source code files, determine file existence or overwrite arbitrary files in the cgi-bin directory.

Platforms Affected:

  • Barracuda Networks, Barracuda Spam Firewall 3.1.16
  • Barracuda Networks, Barracuda Spam Firewall 3.1.17

Remedy:

Upgrade to the latest firmware for Barracuda Spam Firewall (3.1.18 or later), available from Barracuda Networks Web site. See References.

Consequences:

Obtain Information

References:

  • Barracuda Networks Web site, Barracuda Networks - Spam Filter / Spam Firewall / Spam Appliance Specialists at http://www.barracudanetworks.com/products/.
  • SecuriWeb.inc, SecuriWeb Advisory 2005.1 at http://securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1.
  • CVE-2005-2849: Argument injection vulnerability in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to (1) read portions of source code via the -f option to Dig (dig_device.cgi), (2) determine file existence via the -r argument to Tcpdump (tcpdump_device.cgi) or (3) modify files in the cgi-bin directory via the -w argument to Tcpdump.
  • SA16683: Barracuda Spam Firewall Multiple Vulnerabilities
  • SECTRACK ID: 1014837: Barracuda Spam Firewall `img.pl` Discloses Files to Remote Users and Permits Command Execution

Reported:

Sep 01, 2005

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page