Barracuda’s email security gateways bitten by make-me-root vulns

Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges.“We have identified exploitation activity affecting a small number of organizations,” the security vendor said in a late Monday night update to its earlier security advisory.Barracuda declined to answer The Register’s questions, including one about how many organizations have been hit by attackers. A company spokesperson told us that it “worked directly” with the affected businesses “to quickly address the issue. Barracuda acted promptly to remediate the...

Read the full article at the source.