SA127 : PacketShaper S-Series Insecure Cryptographic Parameters
SUMMARY
The HTTPS web UI in PacketShaper S-Series 11.5 may use insecure cryptographic parameters for incoming management connections. A remote attacker who can be a man-in-the-middle, under certain circumstances, may be able to exploit this vulnerability to obtain user authentication credentials. The attacker can then view/modify appliance configuration and view appliance statistics.
AFFECTED PRODUCTS
| PacketShaper S-Series | ||
|---|---|---|
| CVE | Affected Version(s) | Remediation |
| All CVEs | 11.6 and later | Not vulnerable, fixed in 11.6.1.1 |
| 11.5 | Upgrade to 11.5.3.2. | |
| 11.2 - 11.4 | Not vulnerable | |
ADDITIONAL PRODUCT INFORMATION
The HTTPS server in PacketShaper S-Series provides access to the appliance’s web-based Blue Coat Sky UI and Advanced UI. Blue Coat recommends that the PacketShaper S-Series appliance be deployed in a secure network that restricts access to the appliance management network interfaces. Authenticated users who have access to the management interfaces can access the web UI to perform management tasks, such as to modify appliance settings, configure the traffic classification policy, monitor network usage, and generate reports.
This vulnerability can be exploited only through the PacketShaper S-Series management interfaces. If the appliance management network interfaces are not deployed in a secure network, this increases the threat of exploiting the vulnerability.
ISSUES
| CVE-2016-5774 | |
|---|---|
| Severity / CVSSv2 | Medium / 6.9 (AV:A/AC:M/Au:N/C:P/I:P/A:C) |
| References | SecurityFocus: BID 91455 / NVD: CVE-2016-5774 |
| Impact | Information disclosure, unauthorized modification of data |
| Description | It was found that the HTTPS server in PacketShaper S-Series 11.5 may use insecure cryptographic parameters for incoming encrypted SSL/TLS connections. A remote attacker who can be a man-in-the-middle, under certain circumstances, may be able to exploit this vulnerability to obtain user authentication credentials and other sensitive information. The attacker can then use the authentication credentials to view or modify the appliance configuration and statistics provided by the web UI and CLI. |
ACKNOWLEDGEMENTS
Thanks to Kristen Petra Dorey from Western University for reporting the vulnerability.
REVISION
2016-06-24 initial public release