Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Security App Flaws :: b06-3986.htm

Barracuda Vulnerability: Arbitrary File Disclosure



Barracuda Vulnerability: Arbitrary File Disclosure
Barracuda Vulnerability: Arbitrary File Disclosure



Title: Barracuda Arbitrary File Disclosure=0D
Severity: High (Sensitive Information Disclosure)=0D
Date: 01 August 2006=0D
Version Affected: Barracuda Spam Firewall version 3.3.01.001 to 3.3.03.053=0D
Discovered by: Greg Sinclair (gssincla@nnlsoftware.com)=0D 
Discovered on: 29 May 2006=0D
=0D
Overview:=0D
Barracuda Spam Firewalls (www.barracudanetworks.com) are vulnerable to=0D 
arbitrary file disclosure due to improper parameter sanitation.=0D
=0D
Details:=0D
The Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 are vulnerable to arbitrary file disclosure via the preview_email.cgi script.=0D
=0D
The /cgi-bin/preview_email.cgi script is designed to retrieve a message from the local message database on the Barracuda Spam Firewall. However, the "file" parameter which is passed via GET is not properly sanitized to restrict the file retrieval to the message database directories. The script looks for "/mail/mlog" in the file parameter but does not take into account=0D
directory transversal arguments such as ".." The result is that any file that is accessible to the web server user is accessible from the web=0D
interface. The script does require a valid user to be logged in to perform this attack, however using the "Barracuda Hardcoded Password Vulnerability" (NNL-20060801-01) guest password vulnerability this restriction can easily be overcome.=0D
=0D
This particular problem is amplified by the fact that it is possible to download the full configuration file for the barracuda. The configuration file is periodically backed-up into the /tmp directory as "/tmp/backup/periodic_config.txt.tmp" =0D
=0D
Message confidentiality is compromised by the fact that an attacker who is able to view the message log screen (which can be done via the guest password vulnerability) can easily view any message on the system.  The message logs are stored as /mail/mlog/X/Y/email_address/msgID where X is the first character of email_address, Y is the second character of email_address, email_address is the recipient's email address and msgID is the message ID assigned to the message in question. So for example if=0D
jon@smith.com received a message with messageID 1234, any user could view the message by entering /mail/mlog/j/o/jon@smith.com/1234=0D 
=0D
Proof of Concept:=0D
=0D
https:///cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp=0D
=0D
Recommendations:=0D
* Never allow your barracuda web interface to be accessible from untrusted networks (especially the Internet)=0D
=0D
* Upgrade to version 3.3.0.54 or later=0D
=0D
=0D
Vendor Contact:=0D
30 May 2006   - Initial Vendor Contact=0D
24 June 2006  - Vendor replies with prospect of fix=0D
17 July 2006  - NNL request status update, no reply=0D
01 Aug 2006   - NNL releases vuln report, notifies vendor of release=0D


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH