Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
social.tchncs.de is one of the many independent Mastodon servers you can use to participate in the fediverse.
A friendly server from Germany – which tends to attract techy people, but welcomes everybody. This is one of the oldest Mastodon instances.

Administered by:

Server stats:

3.9K
active users

social.tchncs.de: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#barracuda

1 post1 participant0 posts today
Public
🛡 H3lium@infosec.exchange/:~# :blinking_cursor:​

Chinese Hackers Exploited New Zero-Day in Barracuda's ESG Appliances

Barracuda has revealed that Chinese threat actors exploited a new zero-day in its Email Security Gateway (ESG) appliances to deploy backdoors on a "limited number" of devices.

Tracked as CVE-2023-7102, the issue relates to a case of arbitrary code execution that resides within a third-party and open-source library named Spreadsheet::ParseExcel that's used by the Amavis scanner within the gateway. Successful exploitation of the new flaw is accomplished by means of a specially crafted Microsoft Excel email attachment.

Spreadsheet::ParseExcel is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Barracuda said it released a security update that has been "automatically applied" on December 21, 2023, and that no further customer action is required.

Source: Barracuda Email Security Gateway Appliance (ESG) Advisory

Tags: #CyberSecurity #ZeroDayExploit #BarracudaESG #CVE-2023-7102 #EmailSecurity #Barracuda 🚨

Barracuda NetworksBarracuda Email Security Gateway Appliance (ESG) Vulnerability
Public
h4sh

I believe the APT that is exploiting these #barracuda ESG vulnerabilities have more 0-days stocked up.

So far, both CVE-2023-2868 (which was used to compromise the #Australian ACT #Government) back in June and the current CVE-2023-7102 are both parsing vulnerabilities on email attachments. That means someone can send a malicious attachment with the exploit, the email (in)security gateway will parse it and that leads to compromise; no one needs to click on it. 2868 was tar files, and 7102 was for excel files.

Given the nature of sophistication of this threat actor and the kind of things they are after, they will not be mass deploying these 0days for access; they will use them carefully to compromise high value targets. I recommend any high value targets to Chinese APTs get rid of Barracuda products.

ExploreLive feeds
About