The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[NEWS] Barracuda Spam Firewall Hardcoded Password Vulnerability


<< Previous INDEX Search src / Print Next >>
From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 2 Aug 2006 15:12:26 +0200
Subject: [NEWS] Barracuda Spam Firewall Hardcoded Password Vulnerability
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060802130750.83B0E57C8@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -




  Barracuda Spam Firewall Hardcoded Password Vulnerability
------------------------------------------------------------------------


SUMMARY

 <http://www.barracudanetworks.com>; Barracuda Spam Firewalls are 
vulnerable to information disclosure which is made possible by a default 
guest password.

DETAILS

Vulnerable Systems:
 * Barracuda Spam Firewall version 3.3.01.001 to 3.3.03.053

Immune Systems:
 * Barracuda Spam Firewall version 3.3.0.54

The Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 have a 
hardcoded password for the "guest" account in the Login.pm script. This 
script is called to validate any user who attempts to login to the 
barracuda's web interface (typically at http://<;deviceIP>:8080 or 
https://<deviceIP>). While the guest account has limited access, the 
following information can be obtained:

 * System configuration including IP accesses, admin IP ACLs
 * Email message logs (but not the content of the messages)
 * Version information of both spam/antivirus definitions and system 
firmware version


Used in conjunction with the vulnerability "Barracuda Arbitrary File 
Disclosure" (NNL-20060801-02), the integrity of the system can be 
compromised. An attacker can use both vulnerabilities to download both 
confidential emails as well as the configuration information (including 
the admin password).

Additionally, while some accounts such as "admin" are bound by user 
definable IP ACLs, the guest account is not. This means that sensitive 
information can be disclosed to ANY IP address regardless of the user 
defined network restrictions.

Proof of Concept:
Enter the username "guest" into the login page of any open barracuda and 
the password "bnadmin99"

Recommendations:
* Never allow your barracuda web interface to be accessible from untrusted 
networks (especially the Internet)
* Upgrade to version 3.3.0.54 or later

Vendor Contact: 
29 May 2006 - Initial Vendor Contact
24 June 2006 - Vendor replies with prospect of fix
17 July 2006 - NNL request status update, no reply
01 Aug 2006 - NNL releases vulnerability report, notifies vendor of 
release


ADDITIONAL INFORMATION

The information has been provided by  <mailto:gssincla@nnlsoftware.com.)> 
Greg Sinclair.




This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected]

DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру