{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Kompromitace br\u00e1n Barracuda ESG vy\u017eaduj\u00edc\u00ed v\u00fdm\u011bnu vybaven\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Barracuda Networks ozn\u00e1mila nutnost fyzick\u00e9 v\u00fdm\u011bny za\u0159\u00edzen\u00ed ESG (Email Security Gateway), kter\u00e1 byla napadena malwarem v d\u016fsledku 0-day zranitelnosti v modulu pro zpracov\u00e1n\u00ed e-mailov\u00fdch p\u0159\u00edloh. Bylo uvedeno, \u017ee instalace d\u0159\u00edve vydan\u00fdch oprav je na blokov\u00e1n\u00ed probl\u00e9mu nedostate\u010dn\u00e1. Podrobnosti nejsou zp\u0159\u00edstupn\u011bny, ale p\u0159edpokl\u00e1d\u00e1 se, \u017ee rozhodnut\u00ed o v\u00fdm\u011bn\u011b vybaven\u00ed bylo u\u010din\u011bno kv\u016fli \u00fatoku, kter\u00fd vedl k instalaci malwaru na n\u00edzk\u00e9 \u00farovni, a nemo\u017enosti jej odstranit prost\u0159ednictv\u00edm v\u00fdm\u011bny firmwaru nebo resetov\u00e1n\u00edm do tov\u00e1rn\u00edho nastaven\u00ed. Za\u0159\u00edzen\u00ed bude vym\u011bn\u011bno zdarma, o n\u00e1hrad\u011b n\u00e1klad\u016f na dopravu a pr\u00e1ci p\u0159i v\u00fdm\u011bn\u011b nen\u00ed specifikov\u00e1no. <\/p>\n

ESG je hardwarov\u011b-softwarov\u00fd komplex pro ochranu podnikov\u00e9 e-mailov\u00e9 komunikace p\u0159ed \u00fatoky, spamem a viry. Dne 18. kv\u011btna byl zaznamen\u00e1n anom\u00e1ln\u00ed provoz z za\u0159\u00edzen\u00ed ESG, kter\u00fd se uk\u00e1zal jako spojen\u00fd s \u0161kodlivou aktivitou. Anal\u00fdza uk\u00e1zala, \u017ee za\u0159\u00edzen\u00ed byla kompromitov\u00e1na vyu\u017eit\u00edm neopraven\u00e9 (0-day) zranitelnosti (CVE-2023-28681), kter\u00e1 umo\u017e\u0148uje vykon\u00e1n\u00ed vlastn\u00edho k\u00f3du zasl\u00e1n\u00edm speci\u00e1ln\u011b konstruovan\u00e9ho e-mailu. Probl\u00e9m byl zp\u016fsoben nedostate\u010dnou kontrolou n\u00e1zv\u016f soubor\u016f uvnit\u0159 tar-archiv\u016f, kter\u00e9 byly p\u0159ed\u00e1v\u00e1ny v e-mailov\u00fdch p\u0159\u00edloh\u00e1ch, a umo\u017enil vykon\u00e1n\u00ed libovoln\u00e9ho p\u0159\u00edkazu v syst\u00e9mu s vy\u0161\u0161\u00edmi opr\u00e1vn\u011bn\u00edmi, \u010d\u00edm\u017e bylo obejito escapov\u00e1n\u00ed p\u0159i vykon\u00e1v\u00e1n\u00ed k\u00f3du pomoc\u00ed Perl oper\u00e1toru \"qx\". <\/p>\n

Zranitelnost se nach\u00e1z\u00ed v samostatn\u011b dod\u00e1van\u00fdch za\u0159\u00edzen\u00edch ESG (appliance) s firmwary verz\u00ed od 5.1.3.001 do 9.2.0.006 v\u010detn\u011b. Fakty o vyu\u017e\u00edv\u00e1n\u00ed zranitelnosti jsou zn\u00e1my u\u017e od \u0159\u00edjna 2022 a do kv\u011btna 2023 probl\u00e9mu z\u016fstala pozornost ned\u00e1na. Zranitelnost byla zneu\u017e\u00edv\u00e1na \u00fato\u010dn\u00edky k instalaci na br\u00e1n\u00e1ch n\u011bkolika typ\u016f \u0161kodliv\u00e9ho softwaru \u2014 SALTWATER, SEASPY a SEASIDE, kte\u0159\u00ed poskytuj\u00ed extern\u00ed p\u0159\u00edstup k za\u0159\u00edzen\u00ed (z\u00e1kladn\u00ed vstup) a pou\u017e\u00edvaj\u00ed se k odposlechu d\u016fv\u011brn\u00fdch \u00fadaj\u016f. <\/p>\n

Backdoor SALTWATER byl realizov\u00e1n jako modul mod_udp.so pro SMTP proces bsmtpd a umo\u017enil nahr\u00e1vat a spou\u0161t\u011bt v syst\u00e9mu libovoln\u00e9 soubory, stejn\u011b jako proxy po\u017eadavky a tunelovat provoz na extern\u00ed. server<\/a>Pro z\u00edsk\u00e1n\u00ed kontroly v backdooru byl pou\u017eit odchyt syst\u00e9mov\u00fdch vol\u00e1n\u00ed send, recv a close. <\/p>\n

Malware component SEASIDE was written in Lua and was installed as a module mod_require_helo.lua for the SMTP server, where it monitored incoming HELO\/EHLO commands and identified requests from the control. serveru<\/a> and determined the launch parameters of the reverse shell. <\/p>\n

SEASPY was an executable file BarracudaMailService, installed as a system service. The service used a PCAP-based filter to monitor traffic on ports 25 (SMTP) and 587, activating a backdoor upon detection of a packet with a specific sequence. <\/p>\n

On May 20, Barracuda released an update to fix the vulnerability, which was delivered to all devices on May 21. On June 8, it was announced that the updates were insufficient and users needed to physically replace compromised devices. Users were also advised to change all access keys and credentials that intersected with Barracuda ESG, such as those in linked LDAP\/AD and Barracuda Cloud Control. Preliminary data suggests there are about 11 thousand ESG devices using the Barracuda Networks Spam Firewall smtpd service, which is used in the Email Security Gateway.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Compromise of Barracuda ESG gateways requiring hardware replacement | ProHoster","description":"Barracuda Networks announced the necessity for the physical replacement of ESG (Email Security Gateway) devices infected with malware due to a 0-day vulnerability in the email attachment processing module.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}