CVE-2015-0962: Medium severity barracuda web filter vulnerability

Published May 25, 2015

Updated

Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.

Affected Software

6 affected components

Barracuda Web Filter=7.0

Barracuda Web Filter=7.0.1

Barracuda Web Filter=7.1.0

Barracuda Web Filter=8.0

Barracuda Web Filter=8.0.002

Barracuda Web Filter=8.0.003

Event History

May 25, 2015

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0962?

CVE-2015-0962 is considered to have a medium severity due to its potential for man-in-the-middle attacks.

How do I fix CVE-2015-0962?

To fix CVE-2015-0962, upgrade to Barracuda Web Filter version 8.1.0.005 or later.

What versions of Barracuda Web Filter are affected by CVE-2015-0962?

CVE-2015-0962 affects Barracuda Web Filter versions 7.x and 8.x prior to 8.1.0.005.

What type of attack does CVE-2015-0962 enable?

CVE-2015-0962 enables remote attackers to perform man-in-the-middle attacks on SSL sessions.

Is SSL Inspection the cause of the vulnerability in CVE-2015-0962?

Yes, SSL Inspection being enabled on Barracuda Web Filter creates the vulnerability in CVE-2015-0962.