PRESS RELEASE

SEC Consult's security experts have found critical vulnerabilities in Sophos Web Protection Appliance

The highly-rated product [1] "Web Protection Appliance" (formerly known as Web Appliance) by the global IT security and data protection company Sophos [2] is affected by critical security vulnerabilities (e.g. file disclosure & OS command injection).

An attacker can get unauthorized access to the appliance and plant backdoors or access configuration files containing credentials for other systems (e.g. Active Directory/FTP login) which can be used in further attacks.

Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if HTTPS Scanning feature is in use), including sensitive information like passwords and session cookies, is possible.

If HTTPS Scanning is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed/trustedon all workstations within the company. Due to the identified vulnerabilities this private key can be compromised by an attacker and arbitrary certificates can be signed. These certificates will then pass validation on the client machines, enabling various attacks for further targeting clients (e.g. man-in-the-middle, phishing).

Customers are advised to update to version v3.7.8.2 immediately.

Detailed information can be found in SEC Consult's final advisories. The release of this information was agreed with Sophos to be published on 3rd April 2013 here:

https://www.sec-consult.com/de/Vulnerability-Lab/Advisories.htm

Sophos has already released their security release notes for the identified flaws:

http://www.sophos.com/en-us/support/knowledgebase/118969.aspx

SEC Consult has also already contacted CERT teams: US-CERT, CERT.at (Austria) and CERT-Bund (BSI Germany).

Relevant CVE IDs:

1) Unauthenticated local file disclosure (CVE-2013-2641)

2) OS command injection (CVE-2013-2642)

3) Reflected Cross Site Scripting (XSS) (CVE-2013-2643)