Network and email security firm Barracuda says it remotely patched all active Email Security Gateway (ESG) appliances on December 21 against a zero-day bug exploited by UNC4841 Chinese hackers. The company deployed a second wave of security updates a day later on already compromised ESG appliances where the attackers deployed SeaSpy and Saltwater malware. Disclosed on Christmas Eve and tracked as CVE-2023-7102, the zero-day is due to a weakness in the Spreadsheet::ParseExcel third-party library used by the Amavis virus scanner running on Barracuda ESG appliances. Attackers can exploit the flaw to execute arbitrary code on unpatched ESG appliances through parameter injection. The company also filed the CVE-2023-7101 CVE ID to track the bug separately in the open-source library, which is still awaiting a patch. "No action is required by customers at this time, and our investigation is ongoing," Barracuda said in an advisory issued on December 24. "Barracuda, working in collaboration with Mandiant, assesses this activity is attributable to continued operations of the China nexus actor tracked as UNC4841. "For organizations utilizing Spreadsheet::ParseExcel in their own products or services, we recommend reviewing CVE-2023-7101 and promptly taking necessary remediation measures." In May, the same hacker group used another zero-day (CVE-2023-2868) to target Barracuda ESG appliances as part of a cyber-espionage campaign. Barracuda revealed the zero-day had been abused in attacks f...
Barracuda fixes new ESG zero-day exploited by Chinese hackers
BleepingComputer
·Sergiu Gatlan
·Published Dec 27, 2023
·Updated
Affected Software
2 affected components
Barracuda Email Security Gateway
Amavis Spreadsheet::ParseExcel
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the patching of a zero-day vulnerability in Barracuda's Email Security Gateway exploited by Chinese hackers.
2
What security implications are discussed in the article?
The article highlights the risk posed by the zero-day vulnerability that was actively exploited by the UNC4841 hacking group.
3
What products or software are affected by the vulnerability?
The affected products include Barracuda's Email Security Gateway and Amavis's Spreadsheet::ParseExcel.
4
Who are the perpetrators of the exploit mentioned in the article?
The article identifies the hackers as UNC4841, a group believed to be associated with Chinese cyber espionage.
5
What action did Barracuda take in response to the zero-day exploit?
Barracuda remotely patched all active Email Security Gateway appliances to mitigate the vulnerability.