A vulnerability, which was classified as critical, has been found in Barracuda Networks Barracuda Spam Firewall 3.1.16 (Firewall Software). This issue affects an unknown code block of the file dig_device.cgi of the component Firmware. The manipulation of the argument -w with an unknown input leads to a unknown weakness. Impacted is confidentiality, and integrity. The summary by CVE is:

Argument injection vulnerability in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to (1) read portions of source code via the -f option to Dig (dig_device.cgi), (2) determine file existence via the -r argument to Tcpdump (tcpdump_device.cgi) or (3) modify files in the cgi-bin directory via the -w argument to Tcpdump.

The weakness was published 09/08/2005 (Website). It is possible to read the advisory at securitytracker.com. The identification of this vulnerability is CVE-2005-2849 since 09/08/2005. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at 26254 and 26253.

Productinfo

Type

• Firewall Software

Vendor

• Barracuda Networks

Name

• Barracuda Spam Firewall

Version

• 3.1.16

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion