Feeds

Got a Sophos Web Protection box? Make sure it's up to date

Scary vuln left keys to your kingdom up for grabs

5 things you didn’t know about cloud backup

Sophos has plugged security holes in its Web Protection Appliance that could place its customers' internet connections in the hands of eavesdroppers.

The equipment is supposed to filter out suspicious or harmful web traffic for businesses. But the flaws allowed any unauthenticated user to access sensitive configuration files in the product. These documents contain PHP session IDs for the device's superusers, which can be used by miscreants to masquerade as a logged-in administrator.

The files also potentially contain plaintext credentials for other systems, such as FTP and Active Directory servers.

Once authenticated, users can execute arbitrary commands with full privileges on the appliance, plant backdoors, and snoop on encrypted HTTPS communications.

Researchers at Austrian firm SEC Consult unearthed the vulnerabilities and reported them to Sophos.

The Web Protection Appliance is fitted between employees and a business's public internet connection so that all website traffic to and from staff workstations passes through the filter. This makes interception of sensitive information, such as passwords and cookies, possible on compromised appliances.

Grabbing the contents of unencrypted packets would be trivial for a hacker logged into the box, but what about encrypted traffic? Sure enough, the appliance can monitor the contents of HTTPS connections, and it does so by decrypting the data - allowing any infiltrators to snoop on users.

If HTTPS scanning is switched on, the machine holds the private cryptographic key for a Certificate Authority (CA) root certificate that is installed on all workstations within the company. Thanks to the aforementioned vulnerabilities, the attacker can use this key to sign arbitrary SSL certificates that are trusted by the business's computers, opening them up to man-in-the-middle attacks: the worker's computer could be fooled into thinking it was communicating securely with a website, such as Google, when in fact it was sending sensitive data to a miscreant's server.

That's according to SEC Consult, which revealed proof-of-concept exploits and described the flaws as critical in this security advisory.

Sysadmins are advised to update to upgrade the software in the appliances to version v3.7.8.2 as explained in this announcement by Sophos.

In addition, the vendor told El Reg it rolled out updates to its customers in three phases over a two-week period. It said in a statement:

As a security company, keeping our customers safe is our primary responsibility. Improving protection is, of course, key as is ensuring the security of our products. We achieve this through rigorous and regular testing as well as welcoming findings from independent security advisers.

On 21 February 2013, Sophos was contacted by Stefan Viehböck of SEC Consult Vulnerability Lab. His report outlined vulnerabilities discovered by Wolfgang Ettlinger in the web-based user interface (UI) of the Sophos Web Appliance.

The issues reported were resolved with the 3.7.8.2 release of the Sophos Web Appliance software in March 2013. This went to an initial group of customers on March 18, to a larger group on March 25 and will be made available to all remaining customers on April 1.

Sophos added that it "greatly appreciates" the work of Wolfgang Ettlinger, Stefan Vieböck and other security researchers. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.