MVSA-10-006

 
CVE:
CVE-2010-0153
Vendor:
IBM
Products:
Proventia Network Mail Security System

Vulnerabilities:
Cross-Site Request Forgery (XSRF)

Risk:
High
Attack Vector:
From Remote
Authentication:
Required




Description

Web-based Local Management Interface of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to XSRF attacks. When exploited by an attacker, the identified vulnerabilities could lead to compromising the security of the appliance, including unauthorized alteration of appliance's settings, DoS attacks, etc.

Affected Versions


IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)


Mitigation

    
Vendor recommends upgrading to PNMSS firmware 2.5.0.2 or later.
Alternatively, please contact IBM for technical support. 
 
Disclosure Timeline

2009, November 07: Vulnerabilities discovered and documented
2009, November 08: Notification sent to IBM

2009, November 09: IBM acknowledges receiving the report

2010, March: IBM releases PNMSS Firmware 2.5.0.2 correcting the reported issues
2010, September 12: MVSA-10-006 advisory published.

 
MVSA-10-006
Dr. Marian Ventuneac