CVE-2023-2868
Remote command injection in Barracuda Email Security Gateway lets attackers run system commands
The flaw is incomplete validation of file names inside a user-supplied .tar archive, a bundled file, on Barracuda Email Security Gateway appliances. A remote attacker can craft those names so the gateway runs a system command through a Perl feature called the qx operator, with the gateway's privileges. It affects appliance versions 5.1.3.001 through 9.2.0.006 and is fixed in 9.2.0.006 by the BNSF-36456 patch, which the record says was automatically applied to all customer appliances; CISA added it to its known exploited list on 2023-05-26, meaning attackers are using it, and assesses active exploitation.
Barracuda Barracuda Email Security Gateway · Updated 3 Nov · From 1 of our story and the public records
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Barracuda Email Security Gateway 9.2 | 9.2.0.006 |
What to do
- Update Barracuda Email Security Gateway appliances to version 9.2.0.006, the fixed version given in the record.
- Verify that the BNSF-36456 patch has been applied; the record says it was automatically applied to all customer appliances.
- Do not leave affected appliances unpatched, because CISA lists this flaw as known exploited and assesses active exploitation.
What happened
- 26 MayCISA adds the flaw to its known exploited vulnerabilities list.
- 16 JuneUS federal agencies must fix it by this date under CISA's known exploited list.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2023-2868 | Remote Code injection in Barracuda Email Security Gateway | critical 9.4 | 26 May | 87% |