A vulnerability has been reported in various Barracuda products, which can be exploited by malicious users to disclose sensitive information.

Input passed to the "locale" parameter in cgi-mod/view_help.cgi is not properly verified before being used to display files. This can be exploited to disclose the contents of arbitrary files via directory traversal attacks and URL-encoded NULL bytes.

The following products and versions are reportedly affected:
* Barracuda IM Firewall 3.4.01.004 and earlier
* Barracuda Link Balancer 2.1.1.010 and earlier
* Barracuda Load Balancer 3.3.1.005 and earlier
* Barracuda Message Archiver 2.2.1.005 and earlier
* Barracuda Spam & Virus Firewall 4.1.2.006 and earlier
* Barracuda SSL VPN 1.7.2.004 and earlier
* Barracuda Web Application Firewall 7.4.0.022 and earlier
* Barracuda Web Filter 4.3.0.013 and earlier

Solution
Update to the latest available firmware release and enable security definitions.

Provided and/or discovered by
* The vendor credits Randy Janinda and Sanjeev Sinha, SecureWorks
* Reported in Barracuda Spam & Virus Firewall by ShadowHatesYou

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.barracudanetworks.com/ns/support/tech_alert.php

Deep Links
Links available to Secunia VIM customers