Multiple Barracuda Products Security Bypass and Backdoor Unauthorized Access Vulnerabilities

Bugtraq ID:	57537
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 24 2013 12:00AM
Updated:	Jan 24 2013 12:00AM
Credit:	S. Viehböck
Vulnerable:	Barracuda Networks Web Application Firewall 0
Not Vulnerable:

Multiple Barracuda Products Security Bypass and Backdoor Unauthorized Access Vulnerabilities

Multiple Barracuda products are prone to a security-bypass vulnerability and multiple unauthorized-access vulnerabilities.

Attackers can exploit these issues to bypass certain security restrictions and gain unauthorized access to the affected appliances. This may aid in further attacks.

The following are vulnerable:

Barracuda Spam and Virus Firewall
Barracuda Web Filter
Barracuda Message Archiver
Barracuda Web Application Firewall
Barracuda Link Balancer
Barracuda Load Balancer
Barracuda SSL VPN

Multiple Barracuda Products Security Bypass and Backdoor Unauthorized Access Vulnerabilities

An attacker can use readily available tools to exploit these issues.

The researcher has created a proof-of-concept to demonstrate these issues. Please see the references for more information.

Multiple Barracuda Products Security Bypass and Backdoor Unauthorized Access Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Multiple Barracuda Products Security Bypass and Backdoor Unauthorized Access Vulnerabilities

References: