Secret backdoors found in firewall, VPN gear from Barracuda

Secret backdoors found in firewall, VPN gear from Barracuda Networks.

-- Tom

 

Hmm. The work of a disgruntled employee, perhaps?

 

Yikes...

 

Goodness, what a difference a title makes. Here are two I caught yesterday. They are not as thrilling as the one at ARS.

Backdoors Mitigated in a Number of Barracuda Networks Products | threatpost

Backdoors Found in Barracuda Networks Gear — Krebs on Security

I guess undocumented is secret.

 

Also cited:
http://hardware.slashdot.org/story/13/01/24/1618243/

http://www.h-online.com/security/news/item/Backdoors-in-many-Barracuda-appliances-1790947.html

Products affected:
• Barracuda Spam and Virus Firewall
• Barracuda Web Filter
• Barracuda Message Archiver
• Barracuda Web Application Firewall
• Barracuda Link Balancer
• Barracuda Load Balancer
• Barracuda SSL VPN

As the cited Ars article states:

Slightly saddening these went unpatched for that long.

 

Also see:

http://www.cso.com.au/article/451721/barracuda_maintenance_backdoors_open_more_than_support/

http://www.infosecurity-magazine.co...ate-to-version-205-after-backdoor-disclosure/

http://www.theregister.co.uk/2013/01/24/barracuda_backdoor/