<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">We always appreciate quality and accurate security and bug reports against Cudatel, in fact it might even make you some money. You can take a look at details of the program here.<div><br></div><div><a href="http://barracudalabs.com/?page_id=3456">http://barracudalabs.com/?page_id=3456</a></div><div><br></div><div>And yes, we love when those reports include some details of the actual problem as well.</div><div><br></div><div>Mike</div><div><br><div><div>On Jun 28, 2013, at 7:10 AM, Cal Leeming [Simplicity Media Ltd] <<a href="mailto:cal.leeming@simplicitymedialtd.co.uk">cal.leeming@simplicitymedialtd.co.uk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">I assume everyone has already seen this, but here you go.<div><br></div><div>Cal<br><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Henri Salo</b> <span dir="ltr"><<a href="mailto:henri.salo@kapsi.fi">henri.salo@kapsi.fi</a>></span><br>
Date: Fri, Jun 28, 2013 at 8:41 AM<br>Subject: Re: Barracuda CudaTel 2.6.02.04 - Persistent Web Vulnerability<br>To: Vulnerability Lab <<a href="mailto:research@vulnerability-lab.com">research@vulnerability-lab.com</a>><br>
Cc: <a href="mailto:bugtraq@securityfocus.com">bugtraq@securityfocus.com</a><br><br><br>On Fri, Jun 28, 2013 at 12:47:46AM +0100, Vulnerability Lab wrote:<br>
<snip><br>
<div class="im">> (Copy of the Vendor Homepage: <a href="http://www.barracudanetworks.ca/cudatel.aspx" target="_blank">http://www.barracudanetworks.ca/cudatel.aspx</a> )<br>
<br>
</div>What?<br>
<div class="im"><br>
> Report-Timeline:<br>
> ================<br>
> 2012-11-26: Researcher Notification & Coordination (Chokri Ben Achour)<br>
> 2012-11-27: Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program)<br>
> 2013-04-03: Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program)<br>
> 2013-05-02: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordination: Dave Farrow]<br>
> 2012-06-00: Public Disclosure (Vulnerability Laboratory)<br>
<br>
</div>What?<br>
<div class="im"><br>
> Vulnerable Section(s):<br>
> [+] Find Me<br>
><br>
> Vulnerable Module(s):<br>
> [+] Call Forwarding - Add<br>
><br>
> Vulnerable Parameter(s):<br>
> [+] Calling Sequence - Listing<br>
<br>
</div>What?<br>
<br>
Do you hit some "send advisory" -button in your web page without checking the<br>
details? Why don't you just include PoC?<br>
<br>
---<br>
Henri Salo<br>
</div><br></div>
<span><signature.asc></span>_________________________________________________________________________<br>Professional FreeSWITCH Consulting Services:<br><a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>http://www.freeswitchsolutions.com<br><br>FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>http://www.cudatel.com<br><br>Official FreeSWITCH Sites<br>http://www.freeswitch.org<br>http://wiki.freeswitch.org<br>http://www.cluecon.com<br><br>FreeSWITCH-users mailing list<br>FreeSWITCH-users@lists.freeswitch.org<br>http://lists.freeswitch.org/mailman/listinfo/freeswitch-users<br>UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users<br>http://www.freeswitch.org<br></blockquote></div><br></div></body></html>