A Barracuda Networks bejelentette, hogy sz\u00fcks\u00e9g van az ESG (Email Security Gateway) eszk\u00f6z\u00f6k fizikai cser\u00e9j\u00e9re, amelyek rosszindulat\u00fa szoftvereknek voltak kit\u00e9ve a 0-napos sebezhet\u0151s\u00e9g k\u00f6vetkezt\u00e9ben, amely az e-mail mell\u00e9kletek feldolgoz\u00f3 modulja miatt alakult ki. A h\u00edrek szerint a kor\u00e1bban kiadott jav\u00edt\u00e1sok telep\u00edt\u00e9se nem elegend\u0151 a probl\u00e9ma blokkol\u00e1s\u00e1hoz. Tov\u00e1bbi r\u00e9szletek nem ker\u00fcltek nyilv\u00e1noss\u00e1gra, de felt\u00e9telezhet\u0151en a hardver cser\u00e9j\u00e9r\u0151l hozott d\u00f6nt\u00e9st egy t\u00e1mad\u00e1s miatt hozt\u00e1k, amely alacsony szint\u0171 rosszindulat\u00fa szoftver telep\u00edt\u00e9s\u00e9t eredm\u00e9nyezte, \u00e9s amelyet nem lehetett elt\u00e1vol\u00edtani firmware friss\u00edt\u00e9ssel vagy gy\u00e1ri be\u00e1ll\u00edt\u00e1sok vissza\u00e1ll\u00edt\u00e1s\u00e1val. Az eszk\u00f6z\u00f6k ingyenesen cser\u00e9lve lesznek, a sz\u00e1ll\u00edt\u00e1si \u00e9s csere k\u00f6lts\u00e9geinek megt\u00e9r\u00edt\u00e9se nem ker\u00fclt eml\u00edt\u00e9sre. <\/p>\n
Az ESG egy hardver- \u00e9s szoftverkomplexum, amely a v\u00e1llalkoz\u00e1sok e-mailjeinek v\u00e9delm\u00e9t szolg\u00e1lja a t\u00e1mad\u00e1sok, spam \u00e9s v\u00edrusok ellen. M\u00e1jus 18-\u00e1n rendellenes forgalmat \u00e9szleltek az ESG eszk\u00f6z\u00f6kr\u0151l, amely kapcsol\u00f3dott a rosszindulat\u00fa tev\u00e9kenys\u00e9ghez. A vizsg\u00e1lat sor\u00e1n kider\u00fclt, hogy az eszk\u00f6z\u00f6k egy jav\u00edtatlan (0-napos) s\u00e9r\u00fcl\u00e9kenys\u00e9gen (CVE-2023-28681) kereszt\u00fcl kompromitt\u00e1l\u00f3dtak, amely lehet\u0151v\u00e9 teszi a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t egy speci\u00e1lisan megfogalmazott e-mail elk\u00fcld\u00e9s\u00e9vel. A probl\u00e9ma a f\u00e1jlnevek megfelel\u0151 ellen\u0151rz\u00e9s\u00e9nek hi\u00e1ny\u00e1b\u00f3l ad\u00f3dott a tar-arch\u00edvumokban, amelyeket e-mail mell\u00e9kletk\u00e9nt k\u00fcldtek, \u00e9s lehet\u0151v\u00e9 tette tetsz\u0151leges parancs v\u00e9grehajt\u00e1s\u00e1t a rendszerben emelt jogosults\u00e1gokkal, megker\u00fclve a Perl-utas\u00edt\u00e1s «qx» \u00e1ltal a k\u00f3d v\u00e9grehajt\u00e1sakor alkalmazott sz\u0171r\u00e9st. <\/p>\n
A s\u00e9r\u00fcl\u00e9kenys\u00e9g jelen van az ESG (appliance) eszk\u00f6z\u00f6kben, amelyek firmware-e a 5.1.3.001-es verzi\u00f3t\u00f3l a 9.2.0.006-os verzi\u00f3ig terjed. A s\u00e9r\u00fcl\u00e9kenys\u00e9g kihaszn\u00e1l\u00e1s\u00e1ra vonatkoz\u00f3 inform\u00e1ci\u00f3k 2022 okt\u00f3bere \u00f3ta nyomon k\u00f6vethet\u0151k, \u00e9s 2023 m\u00e1jus\u00e1ig probl\u00e9m\u00e1t nem \u00e9szleltek. A s\u00e9r\u00fcl\u00e9kenys\u00e9get a t\u00e1mad\u00f3k k\u00fcl\u00f6nb\u00f6z\u0151 rosszindulat\u00fa programok \u2014 SALTWATER, SEASPY \u00e9s SEASIDE \u2014 telep\u00edt\u00e9s\u00e9re haszn\u00e1lt\u00e1k a gatewayeken, amelyek k\u00fcls\u0151 hozz\u00e1f\u00e9r\u00e9st biztos\u00edtanak az eszk\u00f6zh\u00f6z (h\u00e1ts\u00f3 ajt\u00f3) \u00e9s a bizalmas adatok megszerz\u00e9s\u00e9re alkalmazz\u00e1k. <\/p>\n
A SALTWATER h\u00e1ts\u00f3 ajt\u00f3 mod_udp.so modul form\u00e1j\u00e1ban jelent meg a bsmtpd SMTP folyamat\u00e1ban, \u00e9s lehet\u0151v\u00e9 tette tetsz\u0151leges f\u00e1jlok bet\u00f6lt\u00e9s\u00e9t \u00e9s futtat\u00e1s\u00e1t a rendszeren, valamint lek\u00e9rdez\u00e9sek proxyz\u00e1s\u00e1t \u00e9s a forgalom tunneling-\u00e9t k\u00fcls\u0151 ir\u00e1nyba. szerver<\/a>A h\u00e1ts\u00f3 ajt\u00f3 feletti ir\u00e1ny\u00edt\u00e1shoz a send, recv \u00e9s close rendszerh\u00edv\u00e1sok elfog\u00e1s\u00e1t haszn\u00e1lt\u00e1k. <\/p>\n A SEASIDE k\u00e1rt\u00e9kony \u00f6sszetev\u0151 Lua nyelven k\u00e9sz\u00fclt, mod_require_helo.lua modul form\u00e1j\u00e1ban telep\u00fclt az SMTP szerverre, \u00e9s a HELO\/EHLO parancsok bej\u00f6v\u0151 nyomon k\u00f6vet\u00e9s\u00e9vel, a vez\u00e9rl\u0151vel \u00e9rkez\u0151 lek\u00e9r\u00e9sek azonos\u00edt\u00e1s\u00e1val foglalkozott. a szerver<\/a> \u00e9s a visszanyel\u0151 shell ind\u00edt\u00e1si param\u00e9tereinek meghat\u00e1roz\u00e1s\u00e1val. <\/p>\n A SEASPY egy BarracudaMailService v\u00e9grehajthat\u00f3 f\u00e1jl volt, amely rendszer szerviz form\u00e1j\u00e1ban telep\u00fclt. A szerviz PCAP alap\u00fa sz\u0171r\u0151t haszn\u00e1lt a forgalom nyomon k\u00f6vet\u00e9s\u00e9re a 25 (SMTP) \u00e9s 587 sz\u00e1m\u00fa h\u00e1l\u00f3zati portokon, \u00e9s h\u00e1ts\u00f3 ajt\u00f3t aktiv\u00e1lt, amikor egy k\u00fcl\u00f6nleges sorrend\u0171 csomagot \u00e9rz\u00e9kelt. <\/p>\n M\u00e1jus 20-\u00e1n a Barracuda kiadta a sebezhet\u0151s\u00e9gek jav\u00edt\u00e1s\u00e1ra vonatkoz\u00f3 friss\u00edt\u00e9st, amelyet m\u00e1jus 21-\u00e9n k\u00fcldtek el minden eszk\u00f6zre. J\u00fanius 8-\u00e1n bejelentett\u00e9k, hogy a friss\u00edt\u00e9sek nem elegend\u0151ek, \u00e9s a felhaszn\u00e1l\u00f3knak fizikailag kell helyettes\u00edteni\u00fck a kompromitt\u00e1lt eszk\u00f6z\u00f6ket. A felhaszn\u00e1l\u00f3knak azt is aj\u00e1nlj\u00e1k, hogy cser\u00e9lj\u00e9k le az \u00f6sszes hozz\u00e1f\u00e9r\u00e9si kulcsot \u00e9s azokat a hiteles\u00edt\u0151 adatokat, amelyek \u00e1tfed\u00e9sben voltak a Barracuda ESG-vel, p\u00e9ld\u00e1ul a csatolt LDAP\/AD \u00e9s a Barracuda Cloud Control eset\u00e9ben. El\u0151zetes adatok szerint k\u00f6r\u00fclbel\u00fcl 11 ezer ESG eszk\u00f6z tal\u00e1lhat\u00f3 a h\u00e1l\u00f3zatban, amelyek Barracuda Networks Spam Firewall smtpd szolg\u00e1ltat\u00e1st haszn\u00e1lnak, amely az Email Security Gateway-ben alkalmazott. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A Barracuda ESG \u00e1tj\u00e1r\u00f3k kompromitt\u00e1l\u00e1sa, amely berendez\u00e9sek cser\u00e9j\u00e9t ig\u00e9nyli | ProHoster","description":"A Barracuda Networks bejelentette az ESG (Email Security Gateway) eszk\u00f6z\u00f6k fizikailag sz\u00fcks\u00e9ges cser\u00e9j\u00e9t, amelyek malware \u00e1ltal \u00e9rintettek a 0-napos sebezhet\u0151s\u00e9g miatt az e-mail mell\u00e9kletek feldolgoz\u00e1s\u00e1ra szolg\u00e1l\u00f3 modulban.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"