Symantec Web Gateway < 5.0.3 Multiple Vulnerabilities (SYM12-006) (version check)
critical Nessus Plugin ID 59209
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
A web security application hosted on the remote web server has multiple vulnerabilities.Description
According to its self-reported version number, the remote web server is hosting Symantec Web Gateway before version 5.0.3, which has the following vulnerabilities :-There are multiple cross-site scripting vulnerabilities.
(CVE-2012-0296)
- Multiple shell command injection and local file inclusion vulnerabilities exist that could lead to arbitrary code execution. (CVE-2012-0297)
- Unauthenticated users are allowed to read/delete arbitrary files as root. (CVE-2012-0298)
- A file upload vulnerability exists that could lead to arbitrary code execution. (CVE-2012-0299)
A remote, unauthenticated attacker could exploit the code execution vulnerabilities to execute commands as the apache user. After exploitation, obtaining a root shell is trivial.
Solution
Upgrade to Symantec Web Gateway version 5.0.3 or later.See Also
https://www.tenable.com/security/research/tra-2012-03
https://www.zerodayinitiative.com/advisories/ZDI-12-090/
https://www.zerodayinitiative.com/advisories/ZDI-12-091/
https://www.securityfocus.com/archive/1/523064/30/0/threaded
https://www.securityfocus.com/archive/1/523065/30/0/threaded
Plugin Details
Severity: Critical
ID: 59209
File Name: symantec_web_gateway_sym12-006.nasl
Version: 1.25
Type: remote
Family: CGI abuses
Published: 5/21/2012
Updated: 1/19/2021
Dependencies: symantec_web_gateway_detect.nasl
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:H/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:symantec:web_gateway
Required KB Items: www/symantec_web_gateway
Exploit Available: true
Exploit Ease: No exploit is required
Patch Publication Date: 5/17/2012
Vulnerability Publication Date: 5/4/2012
Exploitable With
CANVAS (D2ExploitPack)
Core Impact
Metasploit (Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability)
Elliot (Symantec Web Gateway 5.0.2 File Upload)
Reference Information
CVE: CVE-2012-0296, CVE-2012-0297, CVE-2012-0298, CVE-2012-0299