Back to list
MVSA-10-006 / CVE-2010-0153 - IBM Proventia Network Mail Security System - Cross-Site Request Forgery vulnerabilities
Sep 12 2010 07:40PM
marian ventuneac gmail com
Security Advisory: MVSA-10-006 / CVE-2010-0153
Products: Proventia Network Mail Security System
Vulnerabilities: Cross-Site Request Forgery (XSRF)
Attack Vector: From Remote
Web-based Local Management Interface (LMI) of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to XSRF attacks. When exploited by an attacker, the identified vulnerabilities could lead to compromising the security of the appliance, including unauthorized alteration of appliance's settings, DoS attacks, etc.
IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)
Vendor recommends upgrading to PNMSS firmware 18.104.22.168 or later.
Alternatively, please contact IBM for technical support.
2009, November 07: Vulnerabilities discovered and documented
2009, November 08: Notification sent to IBM
2009, November 09: IBM acknowledges receiving the report
2010, March: IBM releases PNMSS Firmware 22.214.171.124 correcting the reported issues
2010, September 12: MVSA-10-006 advisory published.
Dr. Marian Ventuneac
[ reply ]
Copyright 2010, SecurityFocus