Fwd: Barracuda CudaTel 2.6.02.04 - Persistent Web Vulnerability
I assume everyone has already seen this, but here you go. Cal ---------- Forwarded message ---------- From: Henri Salo <henri.salo@kapsi.fi> Date: Fri, Jun 28, 2013 at 8:41 AM Subject: Re: Barracuda CudaTel 2.6.02.04 - Persistent Web Vulnerability To: Vulnerability Lab <research@vulnerability-lab.com> Cc: bugtraq@securityfocus.com On Fri, Jun 28, 2013 at 12:47:46AM +0100, Vulnerability Lab wrote: <snip> > (Copy of the Vendor Homepage: http://www.barracudanetworks.ca/cudatel.aspx) What? > Report-Timeline: > ================ > 2012-11-26: Researcher Notification & Coordination (Chokri Ben Achour) > 2012-11-27: Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program) > 2013-04-03: Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program) > 2013-05-02: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordination: Dave Farrow] > 2012-06-00: Public Disclosure (Vulnerability Laboratory) What? > Vulnerable Section(s): > [+] Find Me > > Vulnerable Module(s): > [+] Call Forwarding - Add > > Vulnerable Parameter(s): > [+] Calling Sequence - Listing What? Do you hit some "send advisory" -button in your web page without checking the details? Why don't you just include PoC? --- Henri Salo
We always appreciate quality and accurate security and bug reports against Cudatel, in fact it might even make you some money. You can take a look at details of the program here. http://barracudalabs.com/?page_id=3456 And yes, we love when those reports include some details of the actual problem as well. Mike On Jun 28, 2013, at 7:10 AM, Cal Leeming [Simplicity Media Ltd] <cal.leeming@simplicitymedialtd.co.uk> wrote:
I assume everyone has already seen this, but here you go.
Cal
---------- Forwarded message ---------- From: Henri Salo <henri.salo@kapsi.fi> Date: Fri, Jun 28, 2013 at 8:41 AM Subject: Re: Barracuda CudaTel 2.6.02.04 - Persistent Web Vulnerability To: Vulnerability Lab <research@vulnerability-lab.com> Cc: bugtraq@securityfocus.com
On Fri, Jun 28, 2013 at 12:47:46AM +0100, Vulnerability Lab wrote: <snip>
(Copy of the Vendor Homepage: http://www.barracudanetworks.ca/cudatel.aspx )
What?
Report-Timeline: ================ 2012-11-26: Researcher Notification & Coordination (Chokri Ben Achour) 2012-11-27: Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program) 2013-04-03: Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program) 2013-05-02: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordination: Dave Farrow] 2012-06-00: Public Disclosure (Vulnerability Laboratory)
What?
Vulnerable Section(s): [+] Find Me
Vulnerable Module(s): [+] Call Forwarding - Add
Vulnerable Parameter(s): [+] Calling Sequence - Listing
What?
Do you hit some "send advisory" -button in your web page without checking the details? Why don't you just include PoC?
--- Henri Salo
<signature.asc>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (2)
-
Cal Leeming [Simplicity Media Ltd]
-
Michael Jerris