{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Kompromit\u00e1cia br\u00e1n Barracuda ESG, vy\u017eaduj\u00faca v\u00fdmenu hardv\u00e9ru.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Barracuda Networks ozn\u00e1mila potrebu fyzickej v\u00fdmeny zariaden\u00ed ESG (Email Security Gateway), ktor\u00e9 boli infikovan\u00e9 malwareom v d\u00f4sledku 0-day zranite\u013enosti v modulu spracovania pr\u00edloh e-mailov. Je uveden\u00e9, \u017ee blokovanie probl\u00e9mu predch\u00e1dzaj\u00facimi vydan\u00fdmi z\u00e1platami nie je dostato\u010dn\u00e9. Podrobnosti neboli zverejnen\u00e9, ale predpoklad\u00e1 sa, \u017ee rozhodnutie o v\u00fdmene zariaden\u00ed bolo prijat\u00e9 z d\u00f4vodu \u00fatoku, ktor\u00fd viedol k in\u0161tal\u00e1cii malv\u00e9ru na n\u00edzkej \u00farovni, a nemo\u017enosti odstr\u00e1nenia prostredn\u00edctvom v\u00fdmeny firmv\u00e9ru alebo resetovania do tov\u00e1rensk\u00e9ho nastavenia. Zariadenia bud\u00fa vymenen\u00e9 bez poplatku, o n\u00e1hrade n\u00e1kladov na dopravu a pr\u00e1cu spojen\u00fa s v\u00fdmenou nie s\u00fa nijak\u00e9 podrobnosti. <\/p>\n

ESG je hardv\u00e9rovo-softv\u00e9rov\u00fd komplex na ochranu firemnej elektronickej po\u0161ty pred \u00fatokmi, spamom a v\u00edrusmi. D\u0148a 18. m\u00e1ja bol zaznamenan\u00fd abnorm\u00e1lny traffic z ESG zariaden\u00ed, ktor\u00fd bol spojen\u00fd s \u0161kodlivou aktivitou. Anal\u00fdza uk\u00e1zala, \u017ee zariadenia boli skompromitovan\u00e9 vyu\u017eit\u00edm neopraven\u00e9 (0-day) zranite\u013enosti (CVE-2023-28681), ktor\u00e1 umo\u017e\u0148uje vykonanie vlastn\u00e9ho k\u00f3du prostredn\u00edctvom odoslania \u0161peci\u00e1lne upraven\u00e9ho elektronick\u00e9ho emailu. Probl\u00e9m bol sp\u00f4soben\u00fd nedostato\u010dnou kontrolou n\u00e1zvov s\u00faborov v tar-arch\u00edvoch pren\u00e1\u0161an\u00fdch v po\u0161tov\u00fdch pr\u00edloh\u00e1ch, a umo\u017enil vykona\u0165 \u013eubovo\u013en\u00fd pr\u00edkaz v syst\u00e9me s elevovan\u00fdmi privil\u00e9giami, obch\u00e1dzaj\u00fac eskapovanie pri vykon\u00e1van\u00ed k\u00f3du prostredn\u00edctvom Perl oper\u00e1tora \"qx\". <\/p>\n

Zranite\u013enos\u0165 sa nach\u00e1dza v samostatne dod\u00e1van\u00fdch zariadeniach ESG (appliance) so softv\u00e9rom verzi\u00ed od 5.1.3.001 do 9.2.0.006 vr\u00e1tane. Faktory zneu\u017eitia zranite\u013enosti sa sleduj\u00fa u\u017e od okt\u00f3bra 2022 a do m\u00e1ja 2023 zostala neozn\u00e1men\u00e1. Zranite\u013enos\u0165 bola vyu\u017e\u00edvan\u00e1 \u00fato\u010dn\u00edkmi na in\u0161tal\u00e1ciu viacer\u00fdch typov \u0161kodliv\u00e9ho softv\u00e9ru na br\u00e1nach - SALTWATER, SEASPY a SEASIDE, ktor\u00e9 poskytovali extern\u00fd pr\u00edstup k zariadeniu (backdoor) a pou\u017e\u00edvaj\u00fa sa na zachyt\u00e1vanie d\u00f4vern\u00fdch \u00fadajov. <\/p>\n

Backdoor SALTWATER bol implementovan\u00fd vo forme modulu mod_udp.so do SMTP procesu bsmtpd a umo\u017e\u0148oval na\u010d\u00edtanie a sp\u00fa\u0161\u0165anie \u013eubovo\u013en\u00fdch s\u00faborov v syst\u00e9me, ako aj proxy po\u017eiadavky a tunelovanie prenosu na extern\u00fd. server<\/a>Na z\u00edskanie kontroly bol v backdoore pou\u017eit\u00fd intercept syst\u00e9mov\u00fdch volan\u00ed send, recv a close. <\/p>\n

Malicious component SEASIDE was written in Lua and installed as the module mod_require_helo.lua for the SMTP server, monitoring incoming HELO\/EHLO commands and identifying requests from the control. servera<\/a> and determining the launch parameters of the reverse shell. <\/p>\n

SEASPY was an executable file BarracudaMailService, installed as a system service. The service used a PCAP-based filter to monitor traffic on ports 25 (SMTP) and 587, activating the backdoor upon detecting a packet with a special sequence. <\/p>\n

On May 20, Barracuda released an update to fix the vulnerability, which was deployed to all devices on May 21. On June 8, it was announced that the updates were insufficient and users needed to physically replace the compromised devices. Users are also advised to replace all access keys and credentials that intersected with Barracuda ESG, such as those in linked LDAP\/AD and Barracuda Cloud Control. Preliminary data indicates that about 11 thousand ESG devices, utilizing the Barracuda Networks Spam Firewall smtpd service, which is used in the Email Security Gateway, are affected.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Compromise of Barracuda ESG gateways requiring equipment replacement | ProHoster","description":"Barracuda Networks announced the need for physical replacement of ESG (Email Security Gateway) devices affected by malware due to a 0-day vulnerability in the email attachment processing module.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}