Feeds

Got a Sophos Web Protection box? Make sure it's up to date

Scary vuln left keys to your kingdom up for grabs

Reducing security risks from open source software

Sophos has plugged security holes in its Web Protection Appliance that could place its customers' internet connections in the hands of eavesdroppers.

The equipment is supposed to filter out suspicious or harmful web traffic for businesses. But the flaws allowed any unauthenticated user to access sensitive configuration files in the product. These documents contain PHP session IDs for the device's superusers, which can be used by miscreants to masquerade as a logged-in administrator.

The files also potentially contain plaintext credentials for other systems, such as FTP and Active Directory servers.

Once authenticated, users can execute arbitrary commands with full privileges on the appliance, plant backdoors, and snoop on encrypted HTTPS communications.

Researchers at Austrian firm SEC Consult unearthed the vulnerabilities and reported them to Sophos.

The Web Protection Appliance is fitted between employees and a business's public internet connection so that all website traffic to and from staff workstations passes through the filter. This makes interception of sensitive information, such as passwords and cookies, possible on compromised appliances.

Grabbing the contents of unencrypted packets would be trivial for a hacker logged into the box, but what about encrypted traffic? Sure enough, the appliance can monitor the contents of HTTPS connections, and it does so by decrypting the data - allowing any infiltrators to snoop on users.

If HTTPS scanning is switched on, the machine holds the private cryptographic key for a Certificate Authority (CA) root certificate that is installed on all workstations within the company. Thanks to the aforementioned vulnerabilities, the attacker can use this key to sign arbitrary SSL certificates that are trusted by the business's computers, opening them up to man-in-the-middle attacks: the worker's computer could be fooled into thinking it was communicating securely with a website, such as Google, when in fact it was sending sensitive data to a miscreant's server.

That's according to SEC Consult, which revealed proof-of-concept exploits and described the flaws as critical in this security advisory.

Sysadmins are advised to update to upgrade the software in the appliances to version v3.7.8.2 as explained in this announcement by Sophos.

In addition, the vendor told El Reg it rolled out updates to its customers in three phases over a two-week period. It said in a statement:

As a security company, keeping our customers safe is our primary responsibility. Improving protection is, of course, key as is ensuring the security of our products. We achieve this through rigorous and regular testing as well as welcoming findings from independent security advisers.

On 21 February 2013, Sophos was contacted by Stefan Viehböck of SEC Consult Vulnerability Lab. His report outlined vulnerabilities discovered by Wolfgang Ettlinger in the web-based user interface (UI) of the Sophos Web Appliance.

The issues reported were resolved with the 3.7.8.2 release of the Sophos Web Appliance software in March 2013. This went to an initial group of customers on March 18, to a larger group on March 25 and will be made available to all remaining customers on April 1.

Sophos added that it "greatly appreciates" the work of Wolfgang Ettlinger, Stefan Vieböck and other security researchers. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.