Barracuda patches two ESG flaws that chain to root
Barracuda says the bugs only matter to someone who can already reach the admin interface, and that combining them gets an attacker root on the appliance.
Barracuda Networks has released patches for two vulnerabilities in its Email Security Gateway, and warned that using them together can give an attacker root on the appliance. BleepingComputer reported the advisory on November 3.
The first is an authentication bypass in ESG that lets an unauthenticated remote attacker call a configuration-import function and restore a crafted backup archive, which changes the appliance's global configuration. The second is a command injection: shell metacharacters in the timezone field let an authenticated administrator run OS commands as root when that value is processed later. The second bug also affects the Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
Barracuda's own caveat matters here. It says successful exploitation requires access to the administrative interface of the affected product, and points customers at network access controls and restricting that interface to trusted internal networks. So the bypass isn't a route in from the open internet on its own; it's a step once someone is already knocking on the admin door.
The ESG fixes are BNSF-40425 for 9.4.017 and later, and BNSF-40430 for versions below that. The other products have their own patch IDs in the advisory.
The 2023 comparison is tempting and mostly unhelpful. That campaign, run by UNC4841 against a different ESG flaw, was a zero-day espionage operation that ran for months. Nothing in this advisory says either new bug has been exploited, and the vendor describes the patches as a remediation process rather than a response to an incident.
We'd check first whether the admin interface on any of these appliances is reachable from somewhere it shouldn't be. Then patch, oldest firmware first.
CVE references
Sources
- Barracuda warns of critical flaws allowing root access to devicesPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning