Description
Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be used by any authenticated administrative user to expose the LDAP credentials configured in the LDAP connector over the network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Barracuda | Load Balancer ADC | unspecified – < 6.5 | 6.5 |