SEC Consult Vulnerability Alert: Critical Vulnerabilities In Sophos Web Protection Appliance
Interception of HTTP as well as the plaintext form of HTTPS traffic is possible
SEC Consult's security experts have found critical vulnerabilities in Sophos Web Protection Appliance
The highly-rated product  "Web Protection Appliance" (formerly known as Web Appliance) by the global IT security and data protection company Sophos  is affected by critical security vulnerabilities (e.g. file disclosure & OS command injection).
More Security Insights
- The 12 Critical Questions You Need To Ask When Choosing an AD Bridge Solution
- A New Set of Network Security Challenges
An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (e.g. Active Directory/FTP login) which can be used in further attacks.
Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if HTTPS Scanning feature is in use), including sensitive information like passwords and session cookies, is possible.
If HTTPS Scanning is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed/trustedon all workstations within the company. Due to the identified vulnerabilities this private key can be compromised by an attacker and arbitrary certificates can be signed. These certificates will then pass validation on the client machines, enabling various attacks for further targeting clients (e.g. man-in-the-middle, phishing).
Customers are advised to update to version v188.8.131.52 immediately.
Detailed information can be found in SEC Consult's final advisories. The release of this information was agreed with Sophos to be published on 3rd April 2013 here:
Sophos has already released their security release notes for the identified flaws:
SEC Consult has also already contacted CERT teams: US-CERT, CERT.at (Austria) and CERT-Bund (BSI Germany).
Relevant CVE IDs:
1) Unauthenticated local file disclosure (CVE-2013-2641)
2) OS command injection (CVE-2013-2642)
3) Reflected Cross Site Scripting (XSS) (CVE-2013-2643)