{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Barracuda ESG l\u00fclitite kompromiteerimine, mis vajab seadmete vahetust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Barracuda Networks teatas, et ESG (Email Security Gateway) seadmed, mis on saanud 0-p\u00e4eva haavatavuse t\u00f5ttu pahavaraga nakatunud, vajavad f\u00fc\u00fcsilist asendamist. Teadete kohaselt ei piisa varem v\u00e4lja antud plaastrite paigaldamisest probleemi lahendamiseks. Detailsed andmed puuduvad, kuid t\u00f5en\u00e4oliselt on otsus seadmete asendamise kohta tehtud seoses r\u00fcnnakuga, mis t\u00f5i kaasa pahavara installimise madalal tasemel, ning selle eemaldamine ei ole v\u00f5imalik firmware'i uuendamise v\u00f5i tehase seadetele taastamise kaudu. Seadmestik asendatakse tasuta, kuid transpordi ja vahetust\u00f6\u00f6de kulude h\u00fcvitamise kohta ei ole t\u00e4psustatud. <\/p>\n

ESG on riistvara- ja tarkvarakompleks, mis kaitseb ettev\u00f5tete e-posti r\u00fcnnakute, r\u00e4mpsposti ja viiruste eest. 18. mail registreeriti ESG seadmetest ebanormaalne liiklus, mis osutus seotud kuritahtliku tegevusega. Anal\u00fc\u00fcs n\u00e4itas, et seadmed olid kompromiteeritud, kasutades parandamata (0-p\u00e4eva) haavatavust (CVE-2023-28681), mis v\u00f5imaldas koodi t\u00e4itmist spetsiaalselt kujundatud e-kirja saatmise kaudu. Probleem tekkis, kuna tar-failide nimede kontrollimisel, mis edastati e-posti manustes, puudus n\u00f5uetekohane kontroll, v\u00f5imaldades t\u00e4ita suvalist k\u00e4sku s\u00fcsteemis k\u00f5rgete \u00f5igustega, m\u00f6\u00f6da minnes koodi t\u00e4itmise piiramisest Perl'i operaatori \u201eqx\u201d kaudu. <\/p>\n

Haavatavus esineb eraldi tarnitavates ESG seadmetes (appliance) tarkvaraversioonidega alates 5.1.3.001 kuni 9.2.0.006, kaasa arvatud. Selle haavatavuse kasutamisega seotud juhtumid on j\u00e4lgitavad alates 2022. aasta oktoobrist ning kuni 2023. aasta maini j\u00e4i probleem t\u00e4helepanuta. H\u00e4kkijad kasutasid seda haavatavust, et installida mitut t\u00fc\u00fcpi pahavara, sealhulgas SALTWATER, SEASPY ja SEASIDE, mis v\u00f5imaldavad seadmele v\u00e4ljastpoolt ligip\u00e4\u00e4su (tagaukse) ning on m\u00f5eldud konfidentsiaalsete andmete tabamiseks. <\/p>\n

Tagauks SALTWATER oli vormistatud mod_udp.so moodulina SMTP-protsessis bsmtpd ning v\u00f5imaldas laadida ja k\u00e4ivitada s\u00fcsteemis suvalisi faile, samuti proksida p\u00e4ringuid ja tunnelda liiklust v\u00e4lisse. server<\/a>. Kontrolli saamiseks tagaukses kasutati s\u00fcsteemi k\u00f5nede send, recv ja close pealtkuulamist. <\/p>\n

Rohkem komponent SEASIDE oli kirjutatud Lua keeles, paigaldati moodulina mod_require_helo.lua SMTP-serverisse ning j\u00e4lgis sissetulevaid HELO\/EHLO k\u00e4ske, tuvastades p\u00e4ringud juhtimisse. serverile<\/a> ja m\u00e4\u00e4rates tagurpidi shelli k\u00e4ivitamise parameetreid. <\/p>\n

SEASPY oli BarracudaMailService\u2019i k\u00e4ivitatav fail, mis paigaldati s\u00fcsteemiteenusele. Teenus kasutas PCAP-p\u00f5hist filtrit, et j\u00e4lgida liiklust 25 (SMTP) ja 587 v\u00f5rguportides ning aktiveeris tagaukse, kui tuvastati pakett, millel oli spetsiaalne j\u00e4rjestus. <\/p>\n

20. mail teatas Barracuda uuenduse vabastamisest, mis lahendas haavatavuse, mis oli 21. mail v\u00e4lja saadetud k\u00f5ikidele seadmetele. 8. juunil kuulutati, et uuendamine ei ole piisav ja kasutajad peavad f\u00fc\u00fcsiliselt asendama kompromiteeritud seadmed. Kasutajatele soovitatakse ka asendada k\u00f5ik p\u00e4\u00e4sukoodid ja autentimisandmed, mis olid seotud Barracuda ESG-ga, sealhulgas seotud LDAP\/AD ja Barracuda Cloud Control. Eelinfo kohaselt on v\u00f5rgus umbes 11 000 ESG seadet, mis kasutavad Barracuda Networks Spam Firewall smtpd teenust, mis on rakendatud Email Security Gateway's.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Barracuda ESG v\u00e4rava kompromiteerimine, vajab seadmete vahetamist | ProHoster","description":"Barracuda Networks teatas f\u00fc\u00fcsilise asenduse vajadusest ESG (Email Security Gateway) seadmete puhul, mis on nakatunud pahavara t\u00f5ttu 0-p\u00e4eva haavatavuse t\u00f5ttu e-kirjade manuste t\u00f6\u00f6tlemise moodulis. Teatatakse, et probleemide lahendamiseks ei olnud varasemate plaastrite installimisest piisav. \u00dcksikasju ei jagata, kuid t\u00f5en\u00e4oliselt on seadmete asendamise otsus tehtud r\u00fcnnaku t\u00f5ttu, mis viis pahavara paigaldamiseni.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}