{"id":108919,"date":"2023-06-11T15:10:14","date_gmt":"2023-06-11T13:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108919"},"modified":"2023-06-12T14:16:29","modified_gmt":"2023-06-12T12:16:29","slug":"komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","title":{"rendered":"Kompromitimi i portave Barracuda ESG, q\u00eb k\u00ebrkon z\u00ebvend\u00ebsimin e harduerit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Barracuda Networks shpalli nevoj\u00ebn p\u00ebr nd\u00ebrrimin fizik t\u00eb pajisjeve ESG (Email Security Gateway), t\u00eb prekur nga malware si rezultat i nj\u00eb vulnerabiliteti 0-day n\u00eb modulin e p\u00ebrpunimit t\u00eb bashk\u00ebngjitjeve t\u00eb emailit. Raportohet se bllokimi i problemit me instalimin e patches t\u00eb m\u00ebparshme nuk \u00ebsht\u00eb i mjaftuesh\u00ebm. Detajet nuk jepen, por dyshohet se shkaku i vendimit p\u00ebr nd\u00ebrrimin e pajisjeve \u00ebsht\u00eb nj\u00eb sulm q\u00eb \u00e7oi n\u00eb instalimin e malware n\u00eb nivel t\u00eb ul\u00ebt, dhe pamund\u00ebsin\u00eb e eliminimit t\u00eb tij p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb firmware-it ose rikthimit n\u00eb gjendjen e fabrik\u00ebs. Pajisjet do t\u00eb z\u00ebvend\u00ebsohen falas, por nuk jan\u00eb sakt\u00ebsuar detajet p\u00ebr kompensimin e shpenzimeve p\u00ebr transportin dhe pun\u00ebn e z\u00ebvend\u00ebsimit. <\/p>\n

ESG \u00ebsht\u00eb nj\u00eb kompleks harduese-software p\u00ebr mbrojtjen e post\u00ebs elektronike t\u00eb nd\u00ebrmarrjeve nga sulmet, spami dhe viruset. M\u00eb 18 maj, u regjistrua nj\u00eb trafik anomalesh nga pajisjet ESG, i cili ishte p\u00ebrfshir\u00eb n\u00eb aktivitete t\u00eb d\u00ebmshme. Analiza tregoi se pajisjet ishin kompromentuar, duke p\u00ebrdorur nj\u00eb dob\u00ebsi t\u00eb pap\u00ebrmir\u00ebsuar (0-day) (CVE-2023-28681), e cila lejonte ekzekutimin e kodit t\u00eb tyre p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb emaili t\u00eb formuar posa\u00e7\u00ebrisht. Problemi u shkaktua nga mungesa e kontrollit t\u00eb duhur t\u00eb emrave t\u00eb skedar\u00ebve brenda arkivave tar, t\u00eb kaluara si bashk\u00ebngjitje n\u00eb email, dhe lejonte ekzekutimin e komandave arbitrare n\u00eb sistem me privilegje t\u00eb rritura, duke anashkaluar p\u00ebrjashtimin gjat\u00eb ekzekutimit t\u00eb kodit p\u00ebrmes operatorit Perl 'qx'. <\/p>\n

Vulnerabiliteti \u00ebsht\u00eb i pranish\u00ebm n\u00eb pajisjet ESG (appliance) t\u00eb ofruara ndaras me firmware nga versionet 5.1.3.001 deri n\u00eb 9.2.0.006 p\u00ebrfshir\u00eb. Faktet e shfryt\u00ebzimit t\u00eb vulnerabilitetit jan\u00eb v\u00ebrejtur q\u00eb nga tetori 2022 dhe deri n\u00eb maj 2023 problemi kishte mbetur i pap\u00ebrfytyruar. Vulnerabiliteti \u00ebsht\u00eb p\u00ebrdorur nga sulmuesit p\u00ebr t\u00eb instaluar n\u00eb porta disa lloje t\u00eb malware-it \u2014 SALTWATER, SEASPY dhe SEASIDE, q\u00eb ofrojn\u00eb akses t\u00eb jasht\u00ebm n\u00eb pajisje (backdoor) dhe p\u00ebrdoren p\u00ebr kapjen e t\u00eb dh\u00ebnave t\u00eb ndjeshme. <\/p>\n

Backdoor SALTWATER ishte formuar si nj\u00eb modul mod_udp.so p\u00ebr procesin SMTP bsmtpd dhe lejonte ngarkimin dhe ekzekutimin e skedareve t\u00eb rast\u00ebsishme n\u00eb sistem, si dhe proxy-imin e k\u00ebrkesave dhe tunneling e trafikut n\u00eb t\u00eb jashtme. server<\/a>. P\u00ebr t\u00eb marr\u00eb kontroll mbi backdoor-in, u p\u00ebrdor interceptimi i thirrjeve sistemike send, recv dhe close. <\/p>\n

Komponenti malware SEASIDE ishte shkruar n\u00eb gjuh\u00ebn Lua, instalohej si nj\u00eb modul mod_require_helo.lua p\u00ebr serverin SMTP dhe merrej me p\u00ebrcjelljen e komandave HELO\/EHLO, identifikimin e k\u00ebrkesave nga kontrolluesi server<\/a> dhe p\u00ebrcaktimin e parametrave p\u00ebr nisjen e shell-it t\u00eb kthyer. <\/p>\n

SEASPY ishte nj\u00eb skedar i ekzekutuesh\u00ebm BarracudaMailService, i instaluar si nj\u00eb sh\u00ebrbim sistemik. Sh\u00ebrbimi p\u00ebrdorte nj\u00eb filtrim t\u00eb bazuar n\u00eb PCAP p\u00ebr t\u00eb gjurmuar trafikun n\u00eb portet 25 (SMTP) dhe 587, dhe aktivizonte nj\u00eb backdoor kur zbulonte nj\u00eb paket\u00eb me nj\u00eb sekuenc\u00eb t\u00eb posa\u00e7me. <\/p>\n

M\u00eb 20 maj, kompania Barracuda publikoi nj\u00eb p\u00ebrdit\u00ebsim p\u00ebr t\u00eb riparuar nj\u00eb dob\u00ebsi, e cila u shp\u00ebrnda n\u00eb t\u00eb gjitha pajisjet m\u00eb 21 maj. M\u00eb 8 qershor, u shpall se p\u00ebrdit\u00ebsimi ishte i pamjaftuesh\u00ebm dhe p\u00ebrdoruesit duhej t\u00eb z\u00ebvend\u00ebsonin fizikisht pajisjet e kompromentuara. P\u00ebrdoruesit gjithashtu rekomandohet t\u00eb z\u00ebvend\u00ebsojn\u00eb t\u00eb gjitha \u00e7el\u00ebsat dhe kredencialet e aksesit q\u00eb ishin n\u00eb kontakt me Barracuda ESG, p\u00ebr shembull, n\u00eb t\u00eb lidhurat LDAP\/AD dhe Barracuda Cloud Control. Sipas informacionit paraprak, rreth 11 mij\u00eb pajisje ESG jan\u00eb n\u00eb rrjet q\u00eb p\u00ebrdorin sh\u00ebrbimin Barracuda Networks Spam Firewall smtpd, i cili aplikohet n\u00eb Email Security Gateway.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108919","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Komprometimi i gateway-ve Barracuda ESG, q\u00eb k\u00ebrkon z\u00ebvend\u00ebsim t\u00eb pajisjeve | ProHoster","description":"Kompania Barracuda Networks shpalli nevoj\u00ebn p\u00ebr z\u00ebvend\u00ebsimin fizik t\u00eb pajisjeve ESG (Email Security Gateway), t\u00eb prekur nga malware si rezultat i nj\u00eb dob\u00ebsie 0-day n\u00eb modulin e p\u00ebrpunimit t\u00eb bashk\u00ebngjitjeve t\u00eb emailit. Raportohet se instalimi i patches t\u00eb l\u00ebshuara m\u00eb par\u00eb nuk mjafton p\u00ebr t\u00eb bllokuar problemin. Detajet nuk jan\u00eb dh\u00ebn\u00eb, por supozohet se vendimi p\u00ebr z\u00ebvend\u00ebsimin e pajisjeve \u00ebsht\u00eb marr\u00eb si pasoj\u00eb e nj\u00eb sulmi q\u00eb \u00e7oi n\u00eb instalimin e malware-it n\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Barracuda ESG, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Barracuda Networks \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0437\u0430\u043c\u0435\u043d\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 ESG (Email Security Gateway), \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043a \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442\u0441\u044f, \u043d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0437\u0430\u043c\u0435\u043d\u0435 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u0438\u0437-\u0437\u0430 \u0430\u0442\u0430\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0435\u0439 \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/komprometacziya-shlyuzov-barracuda-esg-trebuyushhaya-zameny-oborudovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-06-11T13:10:14+00:00","article:modified_time":"2023-06-12T12:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"108919","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:31:17","updated":"2026-02-22 15:31:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/108919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=108919"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/108919\/revisions"}],"predecessor-version":[{"id":173049,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/108919\/revisions\/173049"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=108919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=108919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=108919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}