--- title: Towerwall Security / Vulnerability Alert description: Towerwall Security / Vulnerability Alert --- [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/head-logo-2.svg "TowerWall")](https://towerwall.com/) [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/towerwall-logo-white-test.svg "TowerWall")](https://towerwall.com/) - [Our Partners](https://towerwall.com/how-we-protect-you/our-technology-partners/) - Our Solutions - - Our Cybersecurity Solutions - We operationalize infosec, building security solutions that safeguard your most critical assets. - - [Solutions Overview](https://towerwall.com/cybersecurity-solutions/) - [Risk Assessments & Security Reviews](https://towerwall.com/cybersecurity-solutions/risk-assessments-security-reviews/) - [Program & Policy Development](https://towerwall.com/cybersecurity-solutions/program-policy-development/) - [Incident Response & Remediation](https://towerwall.com/cybersecurity-solutions/incident-response-remediation/) - [Managed Detection & Response](https://towerwall.com/cybersecurity-solutions/managed-detection-response/) - - [Compliance & Privacy](https://towerwall.com/cybersecurity-solutions/compliance-privacy/) - [Comprehensive Security Training](https://towerwall.com/cybersecurity-solutions/comprehensive-security-training/) - [Vulnerability Protection](https://towerwall.com/cybersecurity-solutions/vulnerability-protection/) - [Penetration Testing](https://towerwall.com/cybersecurity-solutions/penetration-testing/) - Virtual Security Officers - - Virtual Security Officer - Leverage the experience and security acumen of Towerwall’s on-demand security experts. - - [Virtual Chief Information Security Officer (VCISO)](https://towerwall.com/virtual-security-officers/virtual-chief-information-security-officer-vciso/) - [Virtual Data Protection Officer (vDPO)](https://towerwall.com/virtual-security-officers/virtual-data-protection-officer-vdpo/) - [Virtual Chief Privacy Officer (vCPO)](https://towerwall.com/virtual-security-officers/virtual-chief-privacy-officer-vcpo/) - We Advise - - We Advise - One-size security solutions only lead to failure. - Industries - [Higher Education](https://towerwall.com/industries/higher-education/) - [Financial Services & Banking](https://towerwall.com/industries/financial-services-banking/) - [Healthcare](https://towerwall.com/industries/healthcare/) - [BioPharma & Bio-Therapeutics](https://towerwall.com/industries/biopharma-bio-therapeutics/) - [Retail](https://towerwall.com/industries/retail/) - [Government](https://towerwall.com/industries/government/) - [Catholic Diocese](https://towerwall.com/industries/catholic-diocese-cybersecurity/) - [Cannabis](https://towerwall.com/industries/cannabis/) - [Small Business](https://towerwall.com/industries/small-business/) - [Enterprise](https://towerwall.com/industries/enterprise/) - Trends & Threats - [Remote Workforce](https://towerwall.com/trends-threats/remote-workforce/) - [Vendor Questionnaire](https://towerwall.com/trends-threats/vendor-questionnaire/) - [HIPAA](https://towerwall.com/trends-threats/hipaa/) - [Ransomware](https://towerwall.com/trends-threats/ransomware/) - [GDPR](https://towerwall.com/trends-threats/gdpr/) - [Cloud Security](https://towerwall.com/trends-threats/cloud-security/) - [Phishing](https://towerwall.com/trends-threats/phishing/) - [Cybersecurity Insurance](https://towerwall.com/trends-threats/cybersecurity-insurance/) - [Resources](https://towerwall.com/resources/) - - Resources - Our latest insights, events, and tools to keep you safe. - - [Insights](https://towerwall.com/resources/?resources_category=MTU%3D&focusarea=0&industries=0&search=) - [Webinars](https://towerwall.com/resources/?resources_category=MTg%3D&focusarea=0&industries=0&search=) - [Whitepapers](https://towerwall.com/resources/?resources_category=MTY%3D&focusarea=0&industries=0&search=) - [View All](https://towerwall.com/resources/) - [Company](https://towerwall.com/company/) - - Our Company - We are the industry’s leading cybersecurity preparedness partner. - - [Who We Are](https://towerwall.com/company/) - [Our Team](https://towerwall.com/company/our-team/) - [Our Approach](https://towerwall.com/our-approach/) - [Our Values](https://towerwall.com/company/our-values/) - - [Awards & Recognition](https://towerwall.com/company/awards-recognition/) - [Certifications & Affiliations](https://towerwall.com/company/certifications-affiliations/) - [Community Involvement](https://towerwall.com/company/community-involvement/) - [Careers](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) Topics Security Partners, Security Services, Data Security, Security Regulations, Security Threat, Security Program, Information Security, Application Security, Hackers, cyber-attack, security policy, cybercriminals, Security Alert, information security tips, cannabis, cybersecurity, Enterprise # Towerwall Security / Vulnerability Alert [By Michelle Drolet](https://blog.towerwall.com/author/towerwall2020) [Read More](https://blog.towerwall.com/author/towerwall2020) 1 Minute Read January 28, 2013 **Security researchers from the Vulnerability Lab have** [identified](http://www.youtube.com/watch?v=ICR0iFJkDg0) **a serious security hole that could affect a number of companies which rely on Barracuda products. They’ve discovered a high severity validation filter and exception handling bypass vulnerability in Barracuda’s appliances.** According to the [experts](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml), the input filter that’s designed to block out persistent input attacks is flawed, exposing all security appliances. “The bug is located when processing to [save](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml) the URL path name (DB stored) with attached file. The vulnerability allows the bypassing of the path URL name parse restriction which leads to the execution on a second vulnerable bound module which displays the input as output listing,” the advisory reads. The vulnerable modules – Account MyResource [Display](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml) and File Upload – persistently execute the saved URL path (which can be a malicious code). So how does it work? “The URL path function saves the context of the input path name (parsed) as client side request via URL. If the request is getting bound with the file, which is getting stored (persistent) and displayed later on the overview listings, the code is getting executed unauthorized out of the [security](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml) application context (persistent|server-side),” the experts explain. The researchers say that the flaw can be fixed by parsing the second input request of the “file upload” function and the path URL request. To demonstrate their findings, the experts have published a proof-of-concept video which shows how the input filter in Barracuda [SSL VPN](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml) can be bypassed by a local attacker to execute code persistently. Barracuda [Networks](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml) has been notified of the issues sometime in May, but so far it’s uncertain when a patch will be made available. **Update.** Vulnerability Lab representatives have contacted us to reveal that the security hole has been addressed by Barracuda. More details on the vulnerability, published by the company, are available [here](https://www.barracudanetworks.com/support/techalerts#37). Here is the proof-of-concept [video](http://news.softpedia.com/news/Experts-Find-Filter-Bypass-Vulnerabilities-in-Barracuda-Appliances-Video-281458.shtml) made available by Vulnerability Lab #### Towerwall Security / Vulnerability Alert Back to Top ## Related Insights ### [Towerwall Information/Vulnerability Alert Vol 13.69: Cisco Security Notice](https://blog.towerwall.com/towerwall-informationvulnerability-alert-vol-13-69-cisco-security-notice) Security Partners, Security Services, Data Security, Security Regulations, Security Threat, Security Program, Information Security, Application Security, Hackers, cyber-attack, security policy, cybercriminals, Security Alert, information security tips, cannabis, cybersecurity, Enterprise ### [Hundreds of cloud apps still vulnerable to DROWN](https://blog.towerwall.com/hundreds-cloud-apps-still-vulnerable-drown) Security Partners, Security Services, Data Security, Security Regulations, Security Threat, Security Program, Information Security, Application Security, Hackers, cyber-attack, security policy, cybercriminals, Security Alert, information security tips, cannabis, cybersecurity, Enterprise [View All Insights](https://blog.towerwall.com) × ## Talk with us now about: #### Your security needs. - ![Phone](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/phone-icon.svg "Phone") [Call 774.204.0700](tel:774.204.0700) - ![Mail](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/mail-icon.svg "Mail") [Email Us](mailto:info@towerwall.com) ### The front line of cybersecurity.™ For over 23 years, Towerwall, a woman-owned business, has helped scores of companies safeguard their data and leverage their investment in IT with advanced information security technology solutions and services. Our experience in all facets of information security coupled with serving in the CIO/CISO/ISO roles provides a unique first-hand understanding of the security challenges organizations face daily. ### Connect - - - - - [Career Opportunities](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) © Towerwall, Inc. and its licensees. All rights reserved [Privacy Policy](http://towerwall.com/privacy-policy/) Sitemap [Created by Howbridge](https://meethowbridge.com/) [![Towerwall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/footer-logo.svg "Towerwall")](https://towerwall.com/)