SEC Consult Vulnerability Alert: Critical Vulnerabilities In Sophos Web Protection Appliance
Interception of HTTP as well as the plaintext form of HTTPS traffic is possible
SEC Consult's security experts have found critical vulnerabilities in Sophos Web Protection Appliance
The highly-rated product  "Web Protection Appliance" (formerly known as Web Appliance) by the global IT security and data protection company Sophos  is affected by critical security vulnerabilities (e.g. file disclosure & OS command injection).
More Security Insights
- Forrester Study: The Total Economic Impact of VMware View
- Securing Executives and Highly Sensitive Documents of Corporations Globally
- SaaS and E-Discovery: Navigating Complex Waters
- SaaS 2011: Adoption Soars, Yet Deployment Concerns Linger
An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (e.g. Active Directory/FTP login) which can be used in further attacks.
Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if HTTPS Scanning feature is in use), including sensitive information like passwords and session cookies, is possible.
If HTTPS Scanning is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed/trustedon all workstations within the company. Due to the identified vulnerabilities this private key can be compromised by an attacker and arbitrary certificates can be signed. These certificates will then pass validation on the client machines, enabling various attacks for further targeting clients (e.g. man-in-the-middle, phishing).
Customers are advised to update to version v188.8.131.52 immediately.
Detailed information can be found in SEC Consult's final advisories. The release of this information was agreed with Sophos to be published on 3rd April 2013 here:
Sophos has already released their security release notes for the identified flaws:
SEC Consult has also already contacted CERT teams: US-CERT, CERT.at (Austria) and CERT-Bund (BSI Germany).
Relevant CVE IDs:
1) Unauthenticated local file disclosure (CVE-2013-2641)
2) OS command injection (CVE-2013-2642)
3) Reflected Cross Site Scripting (XSS) (CVE-2013-2643)