Feeds

Got a Sophos Web Protection box? Make sure it's up to date

Scary vuln left keys to your kingdom up for grabs

Choosing a cloud hosting partner with confidence

Sophos has plugged security holes in its Web Protection Appliance that could place its customers' internet connections in the hands of eavesdroppers.

The equipment is supposed to filter out suspicious or harmful web traffic for businesses. But the flaws allowed any unauthenticated user to access sensitive configuration files in the product. These documents contain PHP session IDs for the device's superusers, which can be used by miscreants to masquerade as a logged-in administrator.

The files also potentially contain plaintext credentials for other systems, such as FTP and Active Directory servers.

Once authenticated, users can execute arbitrary commands with full privileges on the appliance, plant backdoors, and snoop on encrypted HTTPS communications.

Researchers at Austrian firm SEC Consult unearthed the vulnerabilities and reported them to Sophos.

The Web Protection Appliance is fitted between employees and a business's public internet connection so that all website traffic to and from staff workstations passes through the filter. This makes interception of sensitive information, such as passwords and cookies, possible on compromised appliances.

Grabbing the contents of unencrypted packets would be trivial for a hacker logged into the box, but what about encrypted traffic? Sure enough, the appliance can monitor the contents of HTTPS connections, and it does so by decrypting the data - allowing any infiltrators to snoop on users.

If HTTPS scanning is switched on, the machine holds the private cryptographic key for a Certificate Authority (CA) root certificate that is installed on all workstations within the company. Thanks to the aforementioned vulnerabilities, the attacker can use this key to sign arbitrary SSL certificates that are trusted by the business's computers, opening them up to man-in-the-middle attacks: the worker's computer could be fooled into thinking it was communicating securely with a website, such as Google, when in fact it was sending sensitive data to a miscreant's server.

That's according to SEC Consult, which revealed proof-of-concept exploits and described the flaws as critical in this security advisory.

Sysadmins are advised to update to upgrade the software in the appliances to version v3.7.8.2 as explained in this announcement by Sophos.

In addition, the vendor told El Reg it rolled out updates to its customers in three phases over a two-week period. It said in a statement:

As a security company, keeping our customers safe is our primary responsibility. Improving protection is, of course, key as is ensuring the security of our products. We achieve this through rigorous and regular testing as well as welcoming findings from independent security advisers.

On 21 February 2013, Sophos was contacted by Stefan Viehböck of SEC Consult Vulnerability Lab. His report outlined vulnerabilities discovered by Wolfgang Ettlinger in the web-based user interface (UI) of the Sophos Web Appliance.

The issues reported were resolved with the 3.7.8.2 release of the Sophos Web Appliance software in March 2013. This went to an initial group of customers on March 18, to a larger group on March 25 and will be made available to all remaining customers on April 1.

Sophos added that it "greatly appreciates" the work of Wolfgang Ettlinger, Stefan Vieböck and other security researchers. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.