Barracuda Email Security Gateway (ESG), Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Web Application Firewall (WAF), Barracuda Web Security Gateway (WSG), Barracuda Message Archiver (BMA), Barracuda WAF Control Center (WCC)

What this is

Some appliances from Barracuda Networks incorrectly process the timezone setting. A specially crafted value can be treated as commands when the setting is later processed.

How it can harm you

Someone who can connect over a network and sign in as an administrator can insert commands into this setting. When it is processed, those commands run with unrestricted system privileges, allowing stored information to be read, changed or deleted and services to be stopped.

How urgent it is

This vulnerability is already being used in attacks. Updating matters because someone with administrator access can use the flaw to run commands with unrestricted system privileges.

Who is affected

Affected releases are Barracuda Email Security Gateway (ESG) from 0 through 9.4.0.27; Barracuda Load Balancer Application Delivery Controller (ADC) from 0 through 6.4.0; Barracuda Web Application Firewall (WAF) from 0 through 11.0.1; Barracuda Web Security Gateway (WSG) from 0 through 16.1.100.100; Barracuda Message Archiver (BMA) from 0 through 5.5.4.0; and Barracuda WAF Control Center (WCC) from 0 through 2.2.1. All upper limits are inclusive.

What to do

Consult the advisory from Barracuda Networks and update to a release it confirms fixes the flaw: newer than 9.4.0.27 for Barracuda Email Security Gateway (ESG); newer than 6.4.0 for Barracuda Load Balancer Application Delivery Controller (ADC); newer than 11.0.1 for Barracuda Web Application Firewall (WAF); newer than 16.1.100.100 for Barracuda Web Security Gateway (WSG); newer than 5.5.4.0 for Barracuda Message Archiver (BMA); and newer than 2.2.1 for Barracuda WAF Control Center (WCC). Exact fixed releases and temporary workarounds are not specified.

How to check your server

Check the installed product name and version, then compare them with the advisory from Barracuda Networks. Use the advisory to confirm which release fixes the flaw for your product.

Check your server for free →