Secunia

Greg Sinclair has reported a vulnerability and a security issue in Barracuda Spam Firewall, which can be exploited by malicious people to bypass certain security restrictions, disclose various information, and potentially compromise a vulnerable system.

1) Input passed to the "file" parameter in preview_email.cgi is not properly verified, before it is used to view files. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks (e.g. message logs).

Example:
https://[host]/cgi-bin/preview_email.cgi?file=/mail/mlog/../[file]

Successful exploitation requires that the user has been authenticated.

This can also be exploited to execute arbitrary shell commands via the "|" pipe character.

2) A default guest account with a hard-coded password exists in Login.pm. This can be exploited to disclose various configuration and version information.

It has also been reported that there exists a default administrator account with a hard-coded password which is only accessible from the local host.

A combination of the two issues can be exploited by a malicious person to disclose the contents of arbitrary files.

The vulnerability and the security issue have been reported in firmware versions 3.3.01.001 through 3.3.03.053. Prior versions may also be affected.

Solution
Update to firmware version 3.3.0.54.
Further details available in Customer Area

Provided and/or discovered by
Greg Sinclair

Additional information provided by Matthew Hall.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area