Security · High impactFan score 65 · Tier A2 sources
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
The Hacker News · By info@thehackernews.com (The Hacker News) ·
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on…
The Brief
- Two flaws in Barracuda's Email Security Gateway, an authentication bypass and a command injection, can be chained.
- The chain lets an attacker run commands as root, the appliance's highest access level, without logging in.
- Barracuda released patches on Monday, and watchTowr published details of the attack chain.
Why it matters
Email gateways sit at the edge of an organisation's mail flow, so root access on one gives an unauthenticated attacker a privileged foothold on that appliance. Teams running the affected appliance should patch it promptly.
Who’s affected
- Organizations running Barracuda Email Security Gateway appliances
What to do
- Apply the patches Barracuda released for the Email Security Gateway.
- #email-security
- #authentication-bypass
- #command-injection
- #appliance-security
- #barracuda
Timeline
Barracuda releases patches for the Email Security Gateway
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
The Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
