Barracuda IM Firewall XSS and script insertion vulnerabilities

Two vulnerabilities have been reported in Barracuda IM Firewall, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks, according to Secunia.

1. Certain unspecified input passed to the SMTP module is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

2. Certain unspecified input related to user reports is not properly sanitized before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user’s browser session in context of an affected site when the malicious data is being viewed.

The vulnerabilities are reported in Barracuda IM Firewall 620 firmware version 4.2.01.004. Other versions may also be affected.

Solution: Reportedly, the vendor has issued a fix. Please contact the vendor for more information.