Unfortunately, Barracuda is not the only occupant of these ranges. Viehböck said he soon found that these devices all were configured out-of-the-box to listen for incoming SSH connections on those undocumented accounts, but that the devices were set to accept connection attempts only from Internet address ranges occupied by Barracuda Networks. SEC Consult found a password file containing a number of other accounts and hashed passwords, some of which were uncomplicated and could be cracked with little effort.
Viehböck found that the username “product” could be used to login and gain access to the device’s MySQL database with no password, which he said would allow an attacker to add new users with administrative privileges to the appliances. Stefan Viehböck, a security researcher at Vienna, Austria-based SEC Consult Vulnerability Lab., discovered in November 2012 that these devices all included undocumented operating system accounts that could be used to access the appliances remotely over the Internet via secure shell (SSH). Worse still, while the backdoor accounts are apparently set up so that they would only be accessible from Internet addresses assigned to Barracuda, they are in fact accessible to potentially hundreds of other companies and network owners.īarracuda’s hardware devices are broadly deployed in corporate environments, including the Barracuda Web Filter, Message Archiver, Web Application Firewall, Link Balancer, and SSL VPN.
contain undocumented backdoor accounts, the company disclosed today. A variety of the latest firewall, spam filter and VPN appliances sold by Campbell, Calif.
0 kommentar(er)
