Feeds

Got a Sophos Web Protection box? Make sure it's up to date

Scary vuln left keys to your kingdom up for grabs

SANS - Survey on application security programs

Sophos has plugged security holes in its Web Protection Appliance that could place its customers' internet connections in the hands of eavesdroppers.

The equipment is supposed to filter out suspicious or harmful web traffic for businesses. But the flaws allowed any unauthenticated user to access sensitive configuration files in the product. These documents contain PHP session IDs for the device's superusers, which can be used by miscreants to masquerade as a logged-in administrator.

The files also potentially contain plaintext credentials for other systems, such as FTP and Active Directory servers.

Once authenticated, users can execute arbitrary commands with full privileges on the appliance, plant backdoors, and snoop on encrypted HTTPS communications.

Researchers at Austrian firm SEC Consult unearthed the vulnerabilities and reported them to Sophos.

The Web Protection Appliance is fitted between employees and a business's public internet connection so that all website traffic to and from staff workstations passes through the filter. This makes interception of sensitive information, such as passwords and cookies, possible on compromised appliances.

Grabbing the contents of unencrypted packets would be trivial for a hacker logged into the box, but what about encrypted traffic? Sure enough, the appliance can monitor the contents of HTTPS connections, and it does so by decrypting the data - allowing any infiltrators to snoop on users.

If HTTPS scanning is switched on, the machine holds the private cryptographic key for a Certificate Authority (CA) root certificate that is installed on all workstations within the company. Thanks to the aforementioned vulnerabilities, the attacker can use this key to sign arbitrary SSL certificates that are trusted by the business's computers, opening them up to man-in-the-middle attacks: the worker's computer could be fooled into thinking it was communicating securely with a website, such as Google, when in fact it was sending sensitive data to a miscreant's server.

That's according to SEC Consult, which revealed proof-of-concept exploits and described the flaws as critical in this security advisory.

Sysadmins are advised to update to upgrade the software in the appliances to version v3.7.8.2 as explained in this announcement by Sophos.

In addition, the vendor told El Reg it rolled out updates to its customers in three phases over a two-week period. It said in a statement:

As a security company, keeping our customers safe is our primary responsibility. Improving protection is, of course, key as is ensuring the security of our products. We achieve this through rigorous and regular testing as well as welcoming findings from independent security advisers.

On 21 February 2013, Sophos was contacted by Stefan Viehböck of SEC Consult Vulnerability Lab. His report outlined vulnerabilities discovered by Wolfgang Ettlinger in the web-based user interface (UI) of the Sophos Web Appliance.

The issues reported were resolved with the 3.7.8.2 release of the Sophos Web Appliance software in March 2013. This went to an initial group of customers on March 18, to a larger group on March 25 and will be made available to all remaining customers on April 1.

Sophos added that it "greatly appreciates" the work of Wolfgang Ettlinger, Stefan Vieböck and other security researchers. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.