Security, application delivery and data protection solutions provider Barracuda Networks is warning customers about a zero-day vulnerability that has been exploited to hack the company’s Email Security Gateway (ESG) appliances.
The zero-day, tracked as CVE-2023-2868, was addressed with a patch (BNSF-36456) that has been automatically applied to all impacted appliances.
An entry in NIST’s vulnerability database describes CVE-2023-2868 as a remote command injection vulnerability affecting versions 5.1.3.001 through 9.2.0.006 of the Barracuda ESG appliance.
“The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl’s qx operator with the privileges of the Email Security Gateway product,” the advisory explains.
Barracuda said the zero-day was discovered on May 19 and a patch was rolled out to all ESG appliances the next day. A second fix was released on May 21 as part of what the company described as its ‘containment strategy’.
“The vulnerability existed in a module which initially screens the attachments of incoming emails. No other Barracuda products, including our SaaS email security services, were subject to this vulnerability,” the company noted.
Barracuda’s investigation, which is ongoing, showed that “the vulnerability resulted in unauthorized access to a subset of email gateway appliances”.
Impacted users have been notified through the ESG user interface and provided with instructions on the actions they need to take.
Barracuda has promised to share updates as its investigation progresses on its status page. In addition, impacted customers are being directly contacted.
“Barracuda’s investigation was limited to the ESG product, and not the customer’s specific environment. Therefore, impacted customers should review their environments and determine any additional actions they want to take,” Barracuda recommended.
Only a few vulnerabilities affecting Barracuda Networks products were publicly disclosed in recent years and there do not appear to be any previous reports of malicious exploitation.
On the other hand, threat actors have been known to target appliances made by F5, Cisco, Fortinet, SonicWall and Sophos.
Related: QNAP Appliances Targeted in New DeadBolt, eCh0raix Ransomware Campaigns
Related: CISA Warns of Two Mitel Vulnerabilities Exploited in Wild
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
Latest News
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
