CVE-2005-2849
Argument injection vulnerability in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to (1) read portions of source code via the -f option to Dig (dig_device.cgi), (2) determine file existence via the -r argument to…
Does this matter?
Lower severity and a low EPSS score (1.39%). Track it; it rarely justifies an emergency change on its own.
Description
Argument injection vulnerability in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to (1) read portions of source code via the -f option to Dig (dig_device.cgi), (2) determine file existence via the -r argument to Tcpdump (tcpdump_device.cgi) or (3) modify files in the cgi-bin directory via the -w argument to Tcpdump.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 1.39% probability · 71th percentile
- CISA KEV
- Not listed
- Affected
- barracuda networks/barracuda spam firewall
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=112560044813390&w=2
- http://secunia.com/advisories/16683/Patch, Vendor Advisory
- http://securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1Patch, Vendor Advisory
- http://www.securitytracker.com/alerts/2005/Sep/1014837.htmlPatch, Vendor Advisory
- http://marc.info/?l=bugtraq&m=112560044813390&w=2
- http://secunia.com/advisories/16683/Patch, Vendor Advisory
- http://securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1Patch, Vendor Advisory
- http://www.securitytracker.com/alerts/2005/Sep/1014837.htmlPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.