Experts of SEC Consult have found critical vulnerabilities in the “Web Protection Alliance” in Sophos, for  example file disclosure and OS command  injection.
Â
Since all web traffic passes through the appliance, interception of HTTP as well as the plaintext form of HTTPS traffic (if HTTPS Scanning feature is in use), including sensitive information like passwords and session cookies, is possible.
Â
If HTTPS scanning is enabled, the appliance holds a private key for a Certificate Authority (CA) certificate that is installed /trusted on all workstations within the company. Due to the identified vulnerabilities, this private key can be compromised by an attacker and arbitrary certificates can be signed. These certificates will then pass validation on the client machines, enabling various attacks for further targeting clients.
Â
Customers are advised to update to version v3.7.8.2 immediately.
