Tech Talk

[Barracuda appliances - backdoors]

FYI...

Barracuda appliances - backdoors ...
- http://h-online.com/-1790947
24 Jan 2013 - "Almost -all- appliances from Barracuda Networks were delivered with a fixed, preset user account through which, using SSH, you can remotely access the device... the following appliances are affected:
• Barracuda Spam and Virus Firewall
• Barracuda Web Filter
• Barracuda Message Archiver
• Barracuda Web Application Firewall
• Barracuda Link Balancer
• Barracuda Load Balancer
• Barracuda SSL VPN
Also affected are the virtual Vx versions of the listed appliances. Barracuda has released a security update* as "Security Definitions 2.0.5"*. The update changes the sshd configuration to only allow cluster, remote and root to log into the system, with the first two accounts using public/private keys and the latter using a password. Barracuda says that the accounts are "essential for customer support" and will not be removed. The filters on the devices are not being changed in the update and Viehboeck believes the root user might still be crackable. He suggests either placing the appliances behind a firewall that blocks incoming connections to port 22 or contacting Barracuda to get expert assistance in disabling the SSH daemon..."
* https://www.barracudanetworks.com/support/techalerts#40
2013-01-23 - "... Customers are advised to update their Security Definitions to v2.0.5 immediately..."

- https://krebsonsecurity.com/2013/01/backdoors-found-in-barracuda-networks-gear/
24 Jan 2013
___

Barracuda SSL VPN Bug Lets Remote Users Bypass Authentication
- http://www.securitytracker.com/id/1028039
Barracuda Web Filter SSH Backdoor Lets Remote Users Access the System
- http://www.securitytracker.com/id/1028038
Barracuda Web Application Firewall SSH Backdoor Lets Remote Users Access the System
- http://www.securitytracker.com/id/1028037
Barracuda SSL VPN SSH Backdoor Lets Remote Users Access the System
- http://www.securitytracker.com/id/1028036
Barracuda Link Balancer SSH Backdoor Lets Remote Users Access the System
- http://www.securitytracker.com/id/1028035