Security · High impactFan score 65 · Tier A2 sources
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
SecurityWeek · By Eduard Kovacs ·
An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances. The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on SecurityWeek .
The Brief
- Two flaws in Barracuda's Email Security Gateway, an authentication bypass and a command injection, can be chained.
- The chain lets an attacker run commands as root, the appliance's highest access level, without logging in.
- Barracuda released patches on Monday, and watchTowr published details of the attack chain.
Why it matters
Email gateways sit at the edge of an organisation's mail flow, so root access on one gives an unauthenticated attacker a privileged foothold on that appliance. Teams running the affected appliance should patch it promptly.
Who’s affected
- Organizations running Barracuda Email Security Gateway appliances
What to do
- Apply the patches Barracuda released for the Email Security Gateway.
- #email-security
- #authentication-bypass
- #command-injection
- #appliance-security
- #barracuda
Timeline
Barracuda releases patches for the Email Security Gateway
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
The Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Full coverage · 2 sources
- 7h ago ↗
The Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login - 2d ago ↗
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
