{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Compromiterea gateway-urilor Barracuda ESG, necesit\u00e2nd \u00eenlocuirea echipamentului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Barracuda Networks a anun\u021bat necesitatea \u00eenlocuirii fizice a dispozitivelor ESG (Email Security Gateway) afectate de malware \u00een urma unei vulnerabilit\u0103\u021bi zero-day \u00een modulul de procesare a ata\u0219amentelor de email. Se raport\u0103 c\u0103 instalarea actualiz\u0103rilor anterioare nu este suficient\u0103 pentru a bloca problema. Detaliile nu sunt specifice, dar se presupune c\u0103 decizia de a \u00eenlocui echipamentele a fost luat\u0103 din cauza unui atac care a condus la instalarea malware-ului la un nivel de baz\u0103 \u0219i imposibilitatea de a-l elimina prin actualizarea firmware-ului sau resetarea la set\u0103rile din fabric\u0103. \u00centreaga \u00eenlocuire a echipamentului va fi gratuit\u0103, dar nu exist\u0103 clarific\u0103ri cu privire la desp\u0103gubirea costurilor de transport \u0219i manoper\u0103 pentru \u00eenlocuire. <\/p>\n

ESG reprezint\u0103 un complex hardware-software pentru protejarea emailurilor companiilor \u00eempotriva atacurilor, spamului \u0219i viru\u0219ilor. Pe 18 mai, a fost \u00eenregistrat un trafic anormal din dispozitivele ESG, care s-a dovedit a fi legat de activitate malware. Analiza a ar\u0103tat c\u0103 dispozitivele au fost compromise prin exploitarea unei vulnerabilit\u0103\u021bi necorectate (0-day) (CVE-2023-28681), care permitea executarea de cod prin trimiterea unui email formatat special. Problema a fost cauzat\u0103 de absen\u021ba unei verific\u0103ri adecvate a numelui fi\u0219ierelor din arhivele tar transmise \u00een ata\u0219amentele email, permi\u021b\u00e2nd executarea unor comenzi arbitrare \u00een sistem cu privilegii ridicate, ocolind escapaarea la executarea codului prin operatorul Perl «qx». <\/p>\n

Vulnerabilitatea este prezent\u0103 \u00een dispozitivele ESG (appliance) furnizate separat, cu firmware-uri \u00een versiunile de la 5.1.3.001 p\u00e2n\u0103 la 9.2.0.006 inclusiv. Faptele exploat\u0103rii vulnerabilit\u0103\u021bii sunt \u00eenregistrate \u00eenc\u0103 din octombrie 2022 \u0219i p\u00e2n\u0103 \u00een mai 2023, problema r\u0103m\u00e2n\u00e2nd neobservat\u0103. Vulnerabilitatea a fost utilizat\u0103 de atacatori pentru a instala pe gateway-uri mai multe tipuri de malware — SALTWATER, SEASPY \u0219i SEASIDE, care ofer\u0103 acces extern la dispozitiv (backdoor) \u0219i sunt folosite pentru interceptarea datelor confiden\u021biale. <\/p>\n

Backdoor-ul SALTWATER a fost implementat sub forma unui modul mod_udp.so \u00een procesul SMTP bsmtpd \u0219i permitea \u00eenc\u0103rcarea \u0219i executarea \u00een sistem a fi\u0219ierelor arbitrare, precum \u0219i proxy-ingul cererilor \u0219i tunelarea traficului c\u0103tre exterior. serverul<\/a>Pentru a ob\u021bine controlul \u00een backdoor, a fost utilizat\u0103 interceptarea apelurilor de sistem send, recv \u0219i close. <\/p>\n

Componentele malware SEASIDE au fost scrise \u00een limbajul Lua, fiind instalate sub forma unui modul mod_require_helo.lua pentru serverul SMTP \u0219i s-au ocupat cu urm\u0103rirea comenzilor de intrare HELO\/EHLO, identific\u00e2nd cererile de control. server<\/a> \u0219i determin\u00e2nd parametrii de lansare ai shell-ului invers. <\/p>\n

SEASPY era un fi\u0219ier executabil BarracudaMailService, instalat ca serviciu de sistem. Serviciul utiliza un filtru bazat pe PCAP pentru a urm\u0103ri traficul pe porturile 25 (SMTP) \u0219i 587 \u0219i activa un backdoor la detectarea unui pachet cu o secven\u021b\u0103 special\u0103. <\/p>\n

Pe 20 mai, compania Barracuda a lansat o actualizare cu o corectare a vulnerabilit\u0103\u021bii, care a fost livrat\u0103 pe toate dispozitivele pe 21 mai. Pe 8 iunie, a fost anun\u021bat c\u0103 actualiz\u0103rile nu sunt suficiente \u0219i utilizatorii trebuie s\u0103 \u00eenlocuiasc\u0103 fizic dispozitivele compromise. Utilizatorilor li se recomand\u0103, de asemenea, s\u0103 \u00eenlocuiasc\u0103 toate cheile de acces \u0219i datele de autentificare care au fost utilizate \u00een leg\u0103tur\u0103 cu Barracuda ESG, de exemplu, \u00een LDAP\/AD \u0219i Barracuda Cloud Control. Potrivit unor surse preliminare, exist\u0103 aproximativ 11.000 de dispozitive ESG \u00een re\u021bea care folosesc serviciul Barracuda Networks Spam Firewall smtpd, care este utilizat \u00een Email Security Gateway.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Compromiterea gateway-urilor Barracuda ESG, care necesit\u0103 \u00eenlocuirea echipamentului | ProHoster","description":"Compania Barracuda Networks a anun\u021bat necesitatea \u00eenlocuirii fizice a dispozitivelor ESG (Email Security Gateway) afectate de malware \u00een urma unei vulnerabilit\u0103\u021bi 0-day \u00een modulul de procesare a ata\u0219amentelor de e-mail.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}