{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Barracuda ESG v\u00e4rava kompromiteerimine, n\u00f5udes seadmete asendamist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Barracuda Networks teatas vajadusest f\u00fc\u00fcsiliselt asendada ESG (Email Security Gateway) seadmed, mis on saanud kahju pahavarast 0-day n\u00f5rkuse t\u00f5ttu e-kirjade manuste t\u00f6\u00f6tlemise moodulis. Teavet selle kohta, et varem v\u00e4lja antud plaastrite paigaldamine ei piisa probleemide lahendamiseks, jagatakse. \u00dcksikasju ei avalikustata, kuid eeldatakse, et seadmete asendamise otsus tehti r\u00fcnnaku t\u00f5ttu, mis viis madala tasandi pahavara paigaldamiseni ning mille eemaldamine ei olnud v\u00f5imalik, kasutades ainult uue tarkvara installimist v\u00f5i seadme tehase seadete taastamist. Seadmed asendatakse tasuta, kuid enne kulude katmise kohta ei ole t\u00e4psustatud. <\/p>\n

ESG on kombinatsioon riist- ja tarkvaras\u00fcsteemist, mis kaitseb ettev\u00f5tete e-posti r\u00fcnnakute, r\u00e4mpsposti ja viiruste eest. 18. mail registreeriti ESG seadmetest ebanormaalne liiklus, mis osutus seotud kurjategijate tegevusega. Anal\u00fc\u00fcs n\u00e4itas, et seadmed olid kompromiteeritud, kasutades parandamata (0-p\u00e4eva) n\u00f5rkust (CVE-2023-28681), mis v\u00f5imaldab k\u00e4itada oma koodi, saates spetsiaalselt vormindatud e-kirja. Probleem tulenes puudulikest failinimede kontrollimistest tar-arhiivides, mis edastatakse e-kirjaga, v\u00f5imaldades t\u00e4ita suvalist k\u00e4sku s\u00fcsteemis k\u00f5rgendatud \u00f5igustega, m\u00f6\u00f6des koodi t\u00e4itmise varjamist Perl'i operaatori \"qx\" kaudu. <\/p>\n

N\u00f5rkus esineb eraldi tarnitavates ESG seadmetes (appliance) tarkvaraversioonidega vahemikus 5.1.3.001 kuni 9.2.0.006 kaasa arvatud. T\u00f5endid n\u00f5rkuse kasutamisest ulatuvad tagasi 2022. aasta oktoobrisse ja maikuuks 2023 j\u00e4i probleem avastamata. N\u00f5rkust kasutasid r\u00fcndajad, et installida seadmetesse erinevat t\u00fc\u00fcpi pahavara \u2014 SALTWATER, SEASPY ja SEASIDE, mis tagavad seadme v\u00e4lise juurdep\u00e4\u00e4su (tagaukse) ja mida kasutatakse konfidentsiaalsete andmete salvestamiseks. <\/p>\n

SALTWATER tagauks oli vormistatud mod_udp.so moodulina SMTP-protsessile bsmtpd, v\u00f5imaldades s\u00fcsteemis laadida ja k\u00e4ivitada suvalisi faile, samuti edastada p\u00e4ringuid ja tunnelda liiklust v\u00e4lisele. server<\/a>. Tagaukse juhtimiseks kasutati s\u00fcsteemikutsungite send, recv ja close pealtkuulamist. <\/p>\n

Kahjustav komponent SEASIDE kirjutati keeles Lua, see installeeriti moodulina mod_require_helo.lua SMTP serverile ja j\u00e4lgis sissetulevaid HELO\/EHLO k\u00e4ske, tuvastades juhtimisk\u00fcsimised. serverilt<\/a> ja m\u00e4\u00e4rates tagasivaatava shelli k\u00e4ivitamise parameetreid. <\/p>\n

SEASPY oli k\u00e4ivitatav fail BarracudaMailService, mis installeeriti s\u00fcsteemiteenuseks. Teenus kasutas PCAP-p\u00f5hist filtrit liikluse j\u00e4lgimiseks 25 (SMTP) ja 587 v\u00f5rguportidel ning aktiveeris tagaukse, kui tuvastati pakett erilise j\u00e4rjestusega. <\/p>\n

20. mail avaldas Barracuda turvapaelu, mis 21. mail toimetati k\u00f5ikidele seadmetele. 8. juunil kuulutati, et uuendused ei ole piisavad ning kasutajad peavad f\u00fc\u00fcsiliselt vahetama kompromiteeritud seadmeid. Kasutajatele soovitatakse samuti vahetada k\u00f5ik juurdep\u00e4\u00e4suv\u00f5tmed ja autentimismeetodid, mis olid seotud Barracuda ESG-ga, n\u00e4iteks seotud LDAP\/AD ja Barracuda Cloud Controliga. Eelkontrollide kohaselt on v\u00f5rgus umbes 11 000 seadmeid ESG, mis kasutavad Barracuda Networks Spam Firewall smtpd teenust, mida rakendatakse Email Security Gateway's.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Barracuda ESG v\u00e4ravate kompromiteerimine n\u00f5uab seadmete vahetust | ProHoster","description":"Barracuda Networks teatas vajadusest f\u00fc\u00fcsiliselt asendada ESG (Email Security Gateway) seadmed, mida on m\u00f5jutanud pahavara 0-p\u00e4eva haavatavuse t\u00f5ttu e-kirjade manuste t\u00f6\u00f6tlemise moodulis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}