Vulnerabilities / Threats
4/3/2013
10:18 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%
Repost This

SEC Consult Vulnerability Alert: Critical Vulnerabilities In Sophos Web Protection Appliance

Interception of HTTP as well as the plaintext form of HTTPS traffic is possible

SEC Consult's security experts have found critical vulnerabilities in Sophos Web Protection Appliance

The highly-rated product [1] "Web Protection Appliance" (formerly known as Web Appliance) by the global IT security and data protection company Sophos [2] is affected by critical security vulnerabilities (e.g. file disclosure & OS command injection).

An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (e.g. Active Directory/FTP login) which can be used in further attacks.

Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if HTTPS Scanning feature is in use), including sensitive information like passwords and session cookies, is possible.

If HTTPS Scanning is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed/trustedon all workstations within the company. Due to the identified vulnerabilities this private key can be compromised by an attacker and arbitrary certificates can be signed. These certificates will then pass validation on the client machines, enabling various attacks for further targeting clients (e.g. man-in-the-middle, phishing).

Customers are advised to update to version v3.7.8.2 immediately.

Detailed information can be found in SEC Consult's final advisories. The release of this information was agreed with Sophos to be published on 3rd April 2013 here:

https://www.sec-consult.com/de/Vulnerability-Lab/Advisories.htm

Sophos has already released their security release notes for the identified flaws:

http://www.sophos.com/en-us/support/knowledgebase/118969.aspx

SEC Consult has also already contacted CERT teams: US-CERT, CERT.at (Austria) and CERT-Bund (BSI Germany).

Relevant CVE IDs:

1) Unauthenticated local file disclosure (CVE-2013-2641)

2) OS command injection (CVE-2013-2642)

3) Reflected Cross Site Scripting (XSS) (CVE-2013-2643)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web