Dr. Marian Ventuneac has reported some vulnerabilities in various Barracuda products, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to various parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in the following products and versions:
* Barracuda Message Archiver Release 1.1.0.010 (2008-02-15) and earlier
* Barracuda Spam Firewall Release 3.5.11.020 (2008-02-26) and earlier
* Barracuda Web Filter Release 3.3.0.038 (2008-02-19) and earlier
* Barracuda IM Firewall Release 3.0.01.008 (2008-02-05) and earlier
* Barracuda Load Balancer Release 2.2.006 (2008-09-05) and earlier

NOTE: An SQL injection error in Barracuda Spam Firewall within the Users -> Account View page has also been reported and fixed.

Solution
Update to the latest version.
Further details available to Secunia VIM customers

Provided and/or discovered by
Dr. Marian Ventuneac, Data Communications Security Laboratory, University of Limerick

Original Advisory
Barracuda Networks:
http://www.barracudanetworks.com/ns/support/tech_alert.php

Dr. Marian Ventuneac:
http://dcsl.ul.ie/advisories/02.htm
http://dcsl.ul.ie/advisories/03.htm

Deep Links
Links available to Secunia VIM customers