Sign-up

ID

VAR-200707-0278


CVE

CVE-2007-3786


TITLE

esoft  of  instagate ex2 utm  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2007-006605

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a former customer. esoft of instagate ex2 utm Exists in unspecified vulnerabilities.None. A remote attacker can perform privileged operations like an administrator. ---------------------------------------------------------------------- Try a new way to discover vulnerabilities that ALREADY EXIST in your IT infrastructure. The Full Featured Secunia Network Software Inspector (NSI) is now available: http://secunia.com/network_software_inspector/ The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT vulnerabilities in more than 4,000 different Windows applications. ---------------------------------------------------------------------- TITLE: eSoft InstaGate Cross-Site Request Forgery Vulnerability SECUNIA ADVISORY ID: SA26005 VERIFY ADVISORY: http://secunia.com/advisories/26005/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: >From remote OPERATING SYSTEM: eSoft InstaGate http://secunia.com/product/14790/ DESCRIPTION: Daniel Weber has reported a vulnerability in eSoft InstaGate, which can be exploited by malicious people to conduct cross-site request forgery attacks. This can be exploited e.g. to change certain settings or to change the administrator's password by enticing a logged-in administrator to visit a malicious site. The vulnerability is reported in eSoft InstaGate EX2. Other versions may also be affected. SOLUTION: Update to firmware version 3.1.20070615 or later. PROVIDED AND/OR DISCOVERED BY: Daniel Weber, Calyptix Security ORIGINAL ADVISORY: http://labs.calyptix.com/CX-2007-05.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.8

sources: NVD: CVE-2007-3786 // JVNDB: JVNDB-2007-006605 // VULHUB: VHN-27148 // PACKETSTORM: 57765

AFFECTED PRODUCTS

vendor:esoftmodel:instagate ex2 utmscope:eqversion:firmware_3.1.20070605

Trust: 1.6

vendor:esoftmodel:instagate ex2 utmscope:eqversion:firmware_3.1.20060921

Trust: 1.6

vendor:esoftmodel:instagate ex2 utmscope:eqversion:firmware_3.1.20031001

Trust: 1.6

vendor:esoftmodel:instagate ex2 utmscope:eqversion:firmware 3.1.20031001

Trust: 0.8

vendor:esoftmodel:instagate ex2 utmscope: - version: -

Trust: 0.8

vendor:esoftmodel:instagate ex2 utmscope:eqversion:firmware 3.1.20070605

Trust: 0.8

vendor:esoftmodel:instagate ex2 utmscope:eqversion:firmware 3.1.20060921

Trust: 0.8

vendor:esoftmodel:instagate ex2 utmscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2007-006605 // CNNVD: CNNVD-200707-261 // NVD: CVE-2007-3786

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-3786
value: HIGH

Trust: 1.0

NVD: CVE-2007-3786
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200707-261
value: CRITICAL

Trust: 0.6

VULHUB: VHN-27148
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-3786
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-27148
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-27148 // JVNDB: JVNDB-2007-006605 // CNNVD: CNNVD-200707-261 // NVD: CVE-2007-3786

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2007-006605 // NVD: CVE-2007-3786

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200707-261

TYPE

unknown

Trust: 0.6

sources: CNNVD: CNNVD-200707-261

EXTERNAL IDS

db:NVDid:CVE-2007-3786

Trust: 3.3

db:SECUNIAid:26005

Trust: 2.6

db:VUPENid:ADV-2007-2539

Trust: 2.5

db:OSVDBid:38174

Trust: 1.9

db:JVNDBid:JVNDB-2007-006605

Trust: 0.8

db:BUGTRAQid:20070711 CALYPTIX SECURITY ADVISORY CX-2007-05 - ESOFT INSTAGATE EX2 CROSS-SITE REQUEST FORGERY ATTACK

Trust: 0.6

db:XFid:35372

Trust: 0.6

db:CNNVDid:CNNVD-200707-261

Trust: 0.6

db:VULHUBid:VHN-27148

Trust: 0.1

db:PACKETSTORMid:57765

Trust: 0.1

sources: VULHUB: VHN-27148 // JVNDB: JVNDB-2007-006605 // PACKETSTORM: 57765 // CNNVD: CNNVD-200707-261 // NVD: CVE-2007-3786

REFERENCES

url:http://labs.calyptix.com/cx-2007-05.txt

Trust: 2.6

url:http://labs.calyptix.com/cx-2007-05.php

Trust: 2.5

url:http://secunia.com/advisories/26005

Trust: 2.5

url:http://www.securityfocus.com/archive/1/473663/100/0/threaded

Trust: 1.9

url:http://osvdb.org/38174

Trust: 1.9

url:http://www.vupen.com/english/advisories/2007/2539

Trust: 1.9

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/35372

Trust: 1.9

url:http://www.eweek.com/article2/0%2c1759%2c2154646%2c00.asp

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2007-3786

Trust: 0.8

url:http://www.eweek.com/article2/0,1759,2154646,00.asp

Trust: 0.7

url:http://xforce.iss.net/xforce/xfdb/35372

Trust: 0.6

url:http://www.securityfocus.com/archive/1/archive/1/473663/100/0/threaded

Trust: 0.6

url:http://www.frsirt.com/english/advisories/2007/2539

Trust: 0.6

url:http://secunia.com/advisories/26005/

Trust: 0.1

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/network_software_inspector/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

url:http://secunia.com/product/14790/

Trust: 0.1

sources: VULHUB: VHN-27148 // JVNDB: JVNDB-2007-006605 // PACKETSTORM: 57765 // CNNVD: CNNVD-200707-261 // NVD: CVE-2007-3786

CREDITS

Secunia

Trust: 0.1

sources: PACKETSTORM: 57765

SOURCES

db:VULHUBid:VHN-27148
db:JVNDBid:JVNDB-2007-006605
db:PACKETSTORMid:57765
db:CNNVDid:CNNVD-200707-261
db:NVDid:CVE-2007-3786

LAST UPDATE DATE

2025-04-10T22:57:36.082000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-27148date:2018-10-15T00:00:00
db:JVNDBid:JVNDB-2007-006605date:2024-07-24T07:33:00
db:CNNVDid:CNNVD-200707-261date:2007-07-18T00:00:00
db:NVDid:CVE-2007-3786date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:VULHUBid:VHN-27148date:2007-07-15T00:00:00
db:JVNDBid:JVNDB-2007-006605date:2024-07-24T00:00:00
db:PACKETSTORMid:57765date:2007-07-17T01:59:39
db:CNNVDid:CNNVD-200707-261date:2007-07-15T00:00:00
db:NVDid:CVE-2007-3786date:2007-07-15T23:30:00