{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Komprometimi i portave Barracuda ESG, q\u00eb k\u00ebrkon z\u00ebvend\u00ebsimin e pajisjeve.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Barracuda Networks shpalli nevoj\u00ebn p\u00ebr z\u00ebvend\u00ebsimin fizik t\u00eb pajisjeve ESG (Email Security Gateway), t\u00eb goditura nga malware p\u00ebr shkak t\u00eb nj\u00eb ndjeshm\u00ebrie 0-day n\u00eb modulin e p\u00ebrpunimit t\u00eb bashk\u00ebngjitjeve t\u00eb emailit. Raportohet se instalimi i patches t\u00eb m\u00ebparshme nuk \u00ebsht\u00eb i mjaftuesh\u00ebm p\u00ebr t\u00eb bllokuar problemin. Detajet nuk jepen, por supozohet se vendimi p\u00ebr z\u00ebvend\u00ebsimin e pajisjeve \u00ebsht\u00eb marr\u00eb p\u00ebr shkak t\u00eb nj\u00eb sulmi q\u00eb \u00e7oi n\u00eb instalimin e malware n\u00eb nivel t\u00eb ul\u00ebt dhe pamund\u00ebsis\u00eb p\u00ebr ta fshir\u00eb at\u00eb p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb firmware ose rikthimit n\u00eb gjendjen fabrikore. Pajisjet do t\u00eb z\u00ebvend\u00ebsohen falas, por nuk jepen Informationen p\u00ebr kompensimin e shpenzimeve t\u00eb d\u00ebrges\u00ebs dhe pun\u00ebs p\u00ebr z\u00ebvend\u00ebsim. <\/p>\n
ESG \u00ebsht\u00eb nj\u00eb kompleks harduerik dhe softuerik p\u00ebr mbrojtjen e post\u00ebs elektronike t\u00eb nd\u00ebrmarrjeve nga sulmet, spami dhe viruset. M\u00eb 18 maj u regjistrua nj\u00eb trafik anormal nga pajisjet ESG, i cili doli t\u00eb ishte i lidhur me aktivitet t\u00eb d\u00ebmsh\u00ebm. Analiza zbuloi se pajisjet ishin komprometuar duke p\u00ebrdorur nj\u00eb vulnerabilitet t\u00eb pap\u00ebrmir\u00ebsuar (0-day) (CVE-2023-28681), i cili lejon ekzekutimin e kodit t\u00eb saj p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb e-maili t\u00eb formatuar ve\u00e7an\u00ebrisht. Problemi u shkaktua nga mungesa e verifikimit t\u00eb duhur t\u00eb emrave t\u00eb skedar\u00ebve brenda arkivave tar, q\u00eb d\u00ebrgoheshin si t\u00eb bashk\u00ebngjitur n\u00eb post\u00eb, dhe lejonte ekzekutimin e komandave t\u00eb rast\u00ebsishme n\u00eb sistem me privilegje t\u00eb larta, duke anashkaluar ekranuarjen gjat\u00eb ekzekutimit t\u00eb kodit p\u00ebrmes operatorit Perl 'qx'. <\/p>\n
Vulnerabiliteti \u00ebsht\u00eb prezent n\u00eb pajisjet ESG t\u00eb ofruara ve\u00e7mas (appliance) me firmware nga versionet 5.1.3.001 deri n\u00eb 9.2.0.006 p\u00ebrfshir\u00eb. Faktet e shfryt\u00ebzimit t\u00eb vulnerabilitetit jan\u00eb ndjekur q\u00eb nga tetori 2022 dhe deri n\u00eb maj 2023 problemi mbeti i paivestiguar. Vulnerabiliteti u shfryt\u00ebzua nga sulmuesit p\u00ebr t\u00eb instaluar n\u00eb gateway disa lloje t\u00eb malware-it \u2014 SALTWATER, SEASPY dhe SEASIDE, q\u00eb ofrojn\u00eb akses t\u00eb jasht\u00ebm n\u00eb pajisje (backdoor) dhe p\u00ebrdoren p\u00ebr t\u00eb kapur t\u00eb dh\u00ebna t\u00eb ndjeshme. <\/p>\n