Barracuda Spam Firewall contains hardcoded default login credentials

Overview

Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 have default login credentials that can not be modified by an administrator.

Description

Barracuda Spam Firewall appliances provide ingress and egress spam filtering for local area networks. An administrator will typically log into the device by supplying credentials to a secure web-interface.

Barracuda Spam Firewalls version 3.3.01.001 to 3.3.02.053 have a guest account with a fixed username and password. This account can log in to the web interface and can not be restricted by the system’s built-in access control lists.

---

Impact

A remote, unauthenticated attacker can view system configuration files or other sensitive data.

---

Solution

Upgrade
Barracuda has published updates that address this issue. Refer to the systems affected portion of this document for more details.

---

Restrict Access
Do not allow access to the web interface of the Barracuda Spam Firewall from untrusted networks.

Block Access to the Web Interface
Blocking access to ports 443/tcp and 8080/tcp will prevent any user from logging into the web-interface, but will not interfere with the spam filtering functions of the firewall.

---

Vendor Information

199348

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Barracuda Networks __ Affected

Updated: August 24, 2006

Status

Affected

Vendor Statement

On August 3, 2006, system settings were delivered to all Barracuda Spam Firewalls in the field via Energize Updates to disable the underlying mechanisms behind these vulnerabilities. As such, no Barracuda Spam Firewalls with current Energize Updates subscriptions should be affected by these vulnerabilities.

As part of the test rollout, these settings were initially delivered with the upgrade to early release firmware 3.4.05.017 on July 14, 2006. These settings were later successfully delivered with the upgrade to generally available firmware 3.3.03.055 on July 18, 2006. While it is generally recommended that customers upgrade to the latest release, these upgrades are no longer necessary for protection against these specific vulnerabilities.

To avoid future vulnerabilities, Barracuda Networks recommends that customers restrict unnecessary external Web access to their Barracuda Spam Firewalls.

Fix:
For firmware version 3.3.x and earlier: upgrade to firmware version 3.3.03.055
For firmware version 3.4.x: upgrade to firmware version 3.4.05.017

For more info:
Email [email protected]
Phone +1 408 342 5400, +1 888 Anti-Spam
Standard Phone or Email Technical Support offered 24 x 7.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://secunia.com/advisories/21258/&gt;
• <http://www.barracudanetworks.com/ns/products/spam_overview.php&gt;

Acknowledgements

Thanks to Greg Sinclair for reporting this vulnerability.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	CVE-2006-4082
Severity Metric:	2.57 Date Public: