Core Security releases security advisory on Kaspersky Labs’ Secure Mail Gateway[scmagazine]

06 Feb 2018

No Comments

1290

Core Security issued an advisory for multiple vulnerabilities it found in Kaspersky Labs’ Secure Mail Gateway that if left unpatched could lead to administrative account takeover.

Core Security researchers found that the Kaspersky Secure Mail Gateway, which is a virtual appliance deployed inside an organization’s network infrastructure that comes bundled with a Web Management Console that monitor the apps operation. However, the console “provides no cross-site request forgery protection site-wide, which could result in administrative account takeover.”

“Multiple vulnerabilities were found in the Kaspersky Mail Gateway Web Management Console. It is possible for a remote attacker to abuse these vulnerabilities and gain command execution as root,” Core Security wrote.

Core Security first came across the issues in September 2017 and notified Kaspersky. After months of going back and forth Core settled on posting the advisory on February 1 and included a link to the update.

For more, click here.