Sign-up

ID

VAR-200812-0243


CVE

CVE-2008-0971


TITLE

plural Barracuda Product index.cgi Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2008-002511

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before 1.2.1.002, Web Filter before 3.3.0.052, IM Firewall before 3.1.01.017, and Load Balancer before 2.3.024 allow remote attackers to inject arbitrary web script or HTML via (1) the Policy Name field in Search Based Retention Policy in Message Archiver; unspecified parameters in the (2) IP Configuration, (3) Administration, (4) Journal Accounts, (5) Retention Policy, and (6) GroupWise Sync components in Message Archiver; (7) input to search operations in Web Filter; and (8) input used in error messages and (9) hidden INPUT elements in (a) Spam Firewall, (b) IM Firewall, and (c) Web Filter. plural Barracuda Product index.cgi Contains a cross-site scripting vulnerability.By any third party through the following process Web Script or HTML May be inserted. Multiple Barracuda products are prone to multiple input-validation vulnerabilities, including multiple cross-site scripting vulnerabilities, an HTML-injection vulnerability, and an SQL-injection vulnerability. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Versions prior to the following are affected: Barracuda Message Archiver to 1.2.1.002. Barracuda Spam Firewall 3.5.12.007 and prior Barracuda Web Filter 3.3.0.052 and prior Barracuda IM Firewall 3.1.01.017 and prior Barracuda Load Balancer 2.3.024 and prior. Barracuda Spam Firewall is an integrated hardware and software spam solution for protecting mail servers. ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: Barracuda Products Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA33164 VERIFY ADVISORY: http://secunia.com/advisories/33164/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: >From remote OPERATING SYSTEM: Barracuda Spam Firewall http://secunia.com/advisories/product/4639/ Barracuda IM Firewall http://secunia.com/advisories/product/20790/ Barracuda Load Balancer http://secunia.com/advisories/product/20791/ Barracuda Message Archiver http://secunia.com/advisories/product/20788/ Barracuda Web Filter http://secunia.com/advisories/product/20789/ DESCRIPTION: Dr. Input passed to various parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. SOLUTION: Update to the latest version. Marian Ventuneac, Data Communications Security Laboratory, University of Limerick ORIGINAL ADVISORY: Barracuda Networks: http://www.barracudanetworks.com/ns/support/tech_alert.php Dr. Marian Ventuneac: http://dcsl.ul.ie/advisories/02.htm http://dcsl.ul.ie/advisories/03.htm ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.16

sources: NVD: CVE-2008-0971 // JVNDB: JVNDB-2008-002511 // BID: 32867 // VULHUB: VHN-31096 // VULMON: CVE-2008-0971 // PACKETSTORM: 73049

AFFECTED PRODUCTS

vendor:barracudamodel:load balancerscope:lteversion:2.2.006

Trust: 1.0

vendor:barracudamodel:im firewallscope:lteversion:3.0.01.008

Trust: 1.0

vendor:barracudamodel:message archiverscope:lteversion:1.1.0.010

Trust: 1.0

vendor:barracudamodel:web filterscope:lteversion:3.3.0.038

Trust: 1.0

vendor:barracudamodel:spam firewallscope:lteversion:3.5.11.020

Trust: 1.0

vendor:barracudamodel:web filterscope:eqversion:3.3.0.038

Trust: 0.9

vendor:barracudamodel:spam firewallscope:eqversion:3.5.11.020

Trust: 0.9

vendor:barracudamodel:message archiverscope:eqversion:1.1.0.010

Trust: 0.9

vendor:barracudamodel:im firewallscope:eqversion:3.0.01.008

Trust: 0.9

vendor:barracudamodel:spam firewallscope:ltversion:3.5.11.025

Trust: 0.8

vendor:barracudamodel:web filterscope:ltversion:3.3.0.052

Trust: 0.8

vendor:barracudamodel:im firewallscope:ltversion:3.1.01.017

Trust: 0.8

vendor:barracudamodel:load balancerscope:ltversion:2.3.024

Trust: 0.8

vendor:barracudamodel:message archiverscope:ltversion:1.2.1.002

Trust: 0.8

vendor:barracudamodel:load balancerscope:eqversion:2.2.006

Trust: 0.6

vendor:barracudamodel:load balancerscope:eqversion:2.2.6

Trust: 0.3

vendor:barracudamodel:web filterscope:neversion:3.3.0.052

Trust: 0.3

vendor:barracudamodel:spam firewallscope:neversion:3.5.12.007

Trust: 0.3

vendor:barracudamodel:message archiverscope:neversion:1.2.1.002

Trust: 0.3

vendor:barracudamodel:load balancerscope:neversion:2.3.24

Trust: 0.3

vendor:barracudamodel:im firewallscope:neversion:3.1.01.017

Trust: 0.3

sources: BID: 32867 // JVNDB: JVNDB-2008-002511 // CNNVD: CNNVD-200812-369 // NVD: CVE-2008-0971

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-0971
value: LOW

Trust: 1.0

NVD: CVE-2008-0971
value: LOW

Trust: 0.8

CNNVD: CNNVD-200812-369
value: LOW

Trust: 0.6

VULHUB: VHN-31096
value: LOW

Trust: 0.1

VULMON: CVE-2008-0971
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2008-0971
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-31096
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-31096 // VULMON: CVE-2008-0971 // JVNDB: JVNDB-2008-002511 // CNNVD: CNNVD-200812-369 // NVD: CVE-2008-0971

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-31096 // JVNDB: JVNDB-2008-002511 // NVD: CVE-2008-0971

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200812-369

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 73049 // CNNVD: CNNVD-200812-369

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2008-002511

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-31096

PATCH
title:Resolved input field validation and HTML encoding issues in select Barracuda Networks productsurl:http://www.barracudanetworks.com/ns/support/tech_alert.php
Trust: 0.8
title:OWASPurl:https://github.com/Ksaivinay0708/OWASP 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2008-0971 // 
            
            
            
            JVNDB: JVNDB-2008-002511

EXTERNAL IDS
db:NVDid:CVE-2008-0971
Trust: 2.9
db:SECUNIAid:33164
Trust: 2.7
db:OSVDBid:50709
Trust: 2.6
db:SECTRACKid:1021454
Trust: 2.6
db:SREASONid:4792
Trust: 1.8
db:JVNDBid:JVNDB-2008-002511
Trust: 0.8
db:BUGTRAQid:20081216 CVE-2008-0971 - BARRACUDA NETWORKS PRODUCTS MULTIPLE CROSS-SITE SCRIPTING VULNERABILITIES
Trust: 0.6
db:CNNVDid:CNNVD-200812-369
Trust: 0.6
db:BIDid:32867
Trust: 0.3
db:PACKETSTORMid:73065
Trust: 0.1
db:VULHUBid:VHN-31096
Trust: 0.1
db:VULMONid:CVE-2008-0971
Trust: 0.1
db:PACKETSTORMid:73049
Trust: 0.1
sources:
            
            
            VULHUB: VHN-31096 // 
            
            
            
            VULMON: CVE-2008-0971 // 
            
            
            
            BID: 32867 // 
            
            
            
            JVNDB: JVNDB-2008-002511 // 
            
            
            
            PACKETSTORM: 73049 // 
            
            
            
            CNNVD: CNNVD-200812-369 // 
            
            
            
            NVD: CVE-2008-0971

REFERENCES
url:http://securitytracker.com/id?1021454
Trust: 2.6
url:http://secunia.com/advisories/33164
Trust: 2.6
url:http://www.barracudanetworks.com/ns/support/tech_alert.php
Trust: 2.2
url:http://dcsl.ul.ie/advisories/03.htm
Trust: 2.2
url:http://www.osvdb.org/50709
Trust: 1.8
url:http://securityreason.com/securityalert/4792
Trust: 1.8
url:http://www.securityfocus.com/archive/1/499294/100/0/threaded
Trust: 1.2
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-0971
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0971
Trust: 0.8
url:http://osvdb.org/50709
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/499294/100/0/threaded
Trust: 0.6
url:http://dcsl.ul.ie/advisories/02.htm
Trust: 0.4
url:http://www.barracudanetworks.com/ns/?l=en_ca
Trust: 0.3
url:/archive/1/499294
Trust: 0.3
url:/archive/1/499293
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/79.html
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=17307
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://secunia.com/advisories/33164/
Trust: 0.1
url:http://secunia.com/advisories/product/4639/
Trust: 0.1
url:http://secunia.com/advisories/product/20791/
Trust: 0.1
url:http://secunia.com/advisories/product/20788/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/product/20789/
Trust: 0.1
url:http://secunia.com/advisories/business_solutions/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/product/20790/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-31096 // 
            
            
            
            VULMON: CVE-2008-0971 // 
            
            
            
            BID: 32867 // 
            
            
            
            JVNDB: JVNDB-2008-002511 // 
            
            
            
            PACKETSTORM: 73049 // 
            
            
            
            CNNVD: CNNVD-200812-369 // 
            
            
            
            NVD: CVE-2008-0971

CREDITS
Marian Ventuneac※ marian.ventuneac@ul.ie
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200812-369

SOURCES
db:VULHUBid:VHN-31096
db:VULMONid:CVE-2008-0971
db:BIDid:32867
db:JVNDBid:JVNDB-2008-002511
db:PACKETSTORMid:73049
db:CNNVDid:CNNVD-200812-369
db:NVDid:CVE-2008-0971

LAST UPDATE DATE
2025-04-10T23:21:34.675000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-31096date:2018-10-15T00:00:00
db:VULMONid:CVE-2008-0971date:2018-10-15T00:00:00
db:BIDid:32867date:2008-12-19T18:42:00
db:JVNDBid:JVNDB-2008-002511date:2011-06-06T00:00:00
db:CNNVDid:CNNVD-200812-369date:2009-01-29T00:00:00
db:NVDid:CVE-2008-0971date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-31096date:2008-12-19T00:00:00
db:VULMONid:CVE-2008-0971date:2008-12-19T00:00:00
db:BIDid:32867date:2008-12-16T00:00:00
db:JVNDBid:JVNDB-2008-002511date:2011-06-06T00:00:00
db:PACKETSTORMid:73049date:2008-12-16T12:16:02
db:CNNVDid:CNNVD-200812-369date:2008-12-19T00:00:00
db:NVDid:CVE-2008-0971date:2008-12-19T17:30:00.267