Symantec Web Gateway < 5.0.3 Multiple Vulnerabilities (SYM12-006) (version check)
critical Nessus Plugin ID 59209
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 8.9
Synopsis
A web security application hosted on the remote web server has multiple vulnerabilities.Description
According to its self-reported version number, the remote web server is hosting Symantec Web Gateway before version 5.0.3, which has the following vulnerabilities :-There are multiple cross-site scripting vulnerabilities.
(CVE-2012-0296)
- Multiple shell command injection and local file inclusion vulnerabilities exist that could lead to arbitrary code execution. (CVE-2012-0297)
- Unauthenticated users are allowed to read/delete arbitrary files as root. (CVE-2012-0298)
- A file upload vulnerability exists that could lead to arbitrary code execution. (CVE-2012-0299)
A remote, unauthenticated attacker could exploit the code execution vulnerabilities to execute commands as the apache user. After exploitation, obtaining a root shell is trivial.
Solution
Upgrade to Symantec Web Gateway version 5.0.3 or later.See Also
https://www.tenable.com/security/research/tra-2012-03
https://www.zerodayinitiative.com/advisories/ZDI-12-090/
https://www.zerodayinitiative.com/advisories/ZDI-12-091/
https://www.securityfocus.com/archive/1/523064/30/0/threaded
https://www.securityfocus.com/archive/1/523065/30/0/threaded
Plugin Details
Severity: Critical
ID: 59209
File Name: symantec_web_gateway_sym12-006.nasl
Version: 1.25
Type: remote
Family: CGI abuses
Published: 5/21/2012
Updated: 1/19/2021
Dependencies: symantec_web_gateway_detect.nasl
Risk Information
Risk Factor: Critical
VPR Score: 8.9
CVSS v2.0
Base Score: 10
Temporal Score: 8.7
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:H/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:symantec:web_gateway
Required KB Items: www/symantec_web_gateway
Exploit Available: true
Exploit Ease: No exploit is required
Patch Publication Date: 5/17/2012
Vulnerability Publication Date: 5/4/2012
Exploitable With
CANVAS (D2ExploitPack)
Core Impact
Metasploit (Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability)
Elliot (Symantec Web Gateway 5.0.2 File Upload)
Reference Information
CVE: CVE-2012-0296, CVE-2012-0297, CVE-2012-0298, CVE-2012-0299