CVE-2015-0962
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle…
Does this matter?
Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.
Description
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-18
- Affected
- barracuda/web filter
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/534407Third Party Advisory, US Government Resource
- https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/Vendor Advisory
- https://techlib.barracuda.com/BWF/UpdateSSLCertsVendor Advisory
- https://www.barracuda.com/support/techalertsVendor Advisory
- http://www.kb.cert.org/vuls/id/534407Third Party Advisory, US Government Resource
- https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/Vendor Advisory
- https://techlib.barracuda.com/BWF/UpdateSSLCertsVendor Advisory
- https://www.barracuda.com/support/techalertsVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.