Signature Detail
Short Name |
APP:SYMC:MESSAGING-SAVE.DO-CSRF |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
APP |
Keywords |
Symantec Messaging Gateway Save.do Cross Site Request Forgery |
Release Date |
2013/01/07 |
Update Number |
2222 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
APP: Symantec Messaging Gateway Save.do Cross Site Request Forgery
This signature detects attempts to exploit a known cross-site request forgery (CSRF) vulnerability against Symantec messaging gateway. It is due to input validation errors when accepting user input. A remote, unauthenticated attacker can exploit this vulnerability by enticing a target user to view crafted web content. A successful attack may result in adding an administrator user to the system.
Extended Description
Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators.
Affected Products
- symantec messaging_gateway 10.0
- symantec messaging_gateway 9.5
- symantec messaging_gateway 9.5.1
- symantec messaging_gateway 9.5.2
- symantec messaging_gateway 9.5.3
- symantec messaging_gateway up to 9.5.4
References
- BugTraq: 55137
- CVE: CVE-2012-0308