Vulnerabilities / Threats
4/3/2013
10:18 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

SEC Consult Vulnerability Alert: Critical Vulnerabilities In Sophos Web Protection Appliance

Interception of HTTP as well as the plaintext form of HTTPS traffic is possible

SEC Consult's security experts have found critical vulnerabilities in Sophos Web Protection Appliance

The highly-rated product [1] "Web Protection Appliance" (formerly known as Web Appliance) by the global IT security and data protection company Sophos [2] is affected by critical security vulnerabilities (e.g. file disclosure & OS command injection).

An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (e.g. Active Directory/FTP login) which can be used in further attacks.

Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if HTTPS Scanning feature is in use), including sensitive information like passwords and session cookies, is possible.

If HTTPS Scanning is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed/trustedon all workstations within the company. Due to the identified vulnerabilities this private key can be compromised by an attacker and arbitrary certificates can be signed. These certificates will then pass validation on the client machines, enabling various attacks for further targeting clients (e.g. man-in-the-middle, phishing).

Customers are advised to update to version v3.7.8.2 immediately.

Detailed information can be found in SEC Consult's final advisories. The release of this information was agreed with Sophos to be published on 3rd April 2013 here:

https://www.sec-consult.com/de/Vulnerability-Lab/Advisories.htm

Sophos has already released their security release notes for the identified flaws:

http://www.sophos.com/en-us/support/knowledgebase/118969.aspx

SEC Consult has also already contacted CERT teams: US-CERT, CERT.at (Austria) and CERT-Bund (BSI Germany).

Relevant CVE IDs:

1) Unauthenticated local file disclosure (CVE-2013-2641)

2) OS command injection (CVE-2013-2642)

3) Reflected Cross Site Scripting (XSS) (CVE-2013-2643)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4907
Published: 2014-07-11
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.

CVE-2014-4908
Published: 2014-07-11
Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper hand...

CVE-2014-2963
Published: 2014-07-10
Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.

CVE-2014-3310
Published: 2014-07-10
The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463.

CVE-2014-3311
Published: 2014-07-10
Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.