Vulnerability Note VU#199348

Barracuda Spam Firewall contains hardcoded default login credentials

Original Release date: 24 Aug 2006 | Last revised: 29 Aug 2006

Overview

Barracuda Spam Firewalls from version 3.3.01.001 to 3.3.02.053 have default login credentials that can not be modified by an administrator.

Description

Barracuda Spam Firewall appliances provide ingress and egress spam filtering for local area networks. An administrator will typically log into the device by supplying credentials to a secure web-interface.

Barracuda Spam Firewalls version 3.3.01.001 to 3.3.02.053 have a guest account with a fixed username and password. This account can log in to the web interface and can not be restricted by the system's built-in access control lists.

Impact

A remote, unauthenticated attacker can view system configuration files or other sensitive data.

Solution

Upgrade
Barracuda has published updates that address this issue. Refer to the systems affected portion of this document for more details.


Restrict Access
Do not allow access to the web interface of the Barracuda Spam Firewall from untrusted networks.

Block Access to the Web Interface
Blocking access to ports 443/tcp and 8080/tcp will prevent any user from logging into the web-interface, but will not interfere with the spam filtering functions of the firewall.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Barracuda NetworksAffected-24 Aug 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Greg Sinclair for reporting this vulnerability.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2006-4082
  • Date Public: 01 Aug 2006
  • Date First Published: 24 Aug 2006
  • Date Last Updated: 29 Aug 2006
  • Severity Metric: 2.56
  • Document Revision: 29

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.