|
|
|
|
| |
Credit:
The information has been provided by Secunia Research.
The original article can be found at: http://secunia.com/secunia_research/2008-19/
|
| |
Vulnerable Systems:
* Akamai Red Swoosh Client version 3322
Immune Systems:
* Akamai Red Swoosh Client version 3333
The Red Swoosh client implements a web server listening on port 9421/TCP on the loopback interface for management commands. Authorisation is restricted based on the HTTP "referer" header. Requests with a "referer" header containing one of a number of domains or no "referer" are fully authorised. By manipulating the HTTP "referer", a malicious web page can cause files from arbitrary URLs to be downloaded and executed.
The Red Swoosh client can be installed manually by visiting the Akamai website. However, more interestingly, it can also be silently installed by the Akamai Download Manager if a download requests Red Swoosh should be used. Once installed, the service or application will run on startup.
The malicious file to be downloaded and executed can potentially be served by the Red Swoosh network alleviating any bandwidth issues on the web server.
Solution:
Update to version 3333.
Time Table:
13/05/2008 - Vendor notified.
13/05/2008 - Vendor response.
06/06/2008 - Public disclosure.
CVE Information:
CVE-2008-1106
|
|
|
|
|
