Barracuda Spam Firewall default account
| barracuda-default-account (28213) |  Medium Risk |
Description:
Barracuda Spam Firewall has a default guest account in the Login.pm script. A remote attacker could use this account to gain unauthorized access to the Web interface and obtain sensitive configuration information. An attacker could use this information to launch further attacks against the affected system.
Platforms Affected:
- Barracuda Networks, Barracuda Spam Firewall 3.3.01.001-3.3.02.05
Remedy:
Upgrade to the latest version of Barracuda Spam Firewall (3.3.0.54 or later), available from Barracuda Networks Web site. See References.
Consequences:
Gain Access
References:
- Barracuda Networks Web site, Barracuda Networks - Spam Filter / Spam Firewall / Spam Appliance Specialists at http://www.barracudanetworks.com/products/.
- BugTraq Mailing List, Tue Aug 01 2006 - 16:18:15 CDT, Barracuda Vulnerability: Hardcoded Password [NNL-20060801-01] at http://archives.neohapsis.com/archives/bugtraq/2006-08/0025.html.
- BID-19276: Barracuda Networks Spam Firewall Multiple Vulnerabilities
- CVE-2006-4001: Login.pm in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 contains a hard-coded password for the guest account, which allows remote attackers to read sensitive information such as e-mail logs, and possibly e-mail contents and the admin password.
- SA21258: Barracuda Spam Firewall Shell Command Injection and Default Account
- VUPEN/ADV-2006-3104: Barracuda Spam Firewall Directory Traversal and Command Execution Vulnerabilities
Reported:
Aug 01, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net