| CVE: |
|
CVE-2010-0153 |
|
| Vendor: |
|
IBM |
|
| Products: |
|
Proventia Network Mail Security System
|
|
| Vulnerabilities: |
|
Cross-Site Request Forgery (XSRF)
|
|
| Risk: |
|
High |
|
| Attack
Vector: |
|
From
Remote |
|
| Authentication: |
|
Required |
|
|
|
|
|
Description
Web-based Local Management Interface of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to XSRF
attacks. When exploited by an attacker, the identified
vulnerabilities could lead to compromising the security of the appliance, including unauthorized alteration of appliance's
settings, DoS attacks, etc.
Affected Versions
IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network
Mail Security System - virtual appliance (firmware 2.5)
Mitigation
Vendor recommends upgrading
to PNMSS firmware 2.5.0.2 or
later.
Alternatively,
please contact IBM for
technical support.
Disclosure Timeline
2009,
November 07: Vulnerabilities discovered and documented
2009,
November 08: Notification sent to IBM
2009,
November 09: IBM acknowledges receiving the report
2010,
March: IBM releases PNMSS Firmware 2.5.0.2 correcting the reported
issues
2010, September 12: MVSA-10-006 advisory published.
MVSA-10-006
Dr.
Marian
Ventuneac
|