SA138 : OS Command Injection Vulnerability in ASG and CA
1401
04 May 2021
03 April 2017
CLOSED
HIGH
CVSS v2: 7.7
SUMMARY
The ASG and CA web-based management consoles are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges.
AFFECTED PRODUCTS
| Advanced Secure Gateway (ASG) | ||
|---|---|---|
| CVE | Affected Release(s) | Remediation |
| All CVEs | 6.7 | Not vulnerable, fixed in 6.7.2.1 |
| 6.6 | Upgrade to 6.6.5.4. | |
| Content Analysis (CA) | ||
|---|---|---|
| CVE | Affected Release(s) | Remediation |
| All CVEs | 2.1 and later | Not vulnerable, fixed in 2.1.1.1 |
| 1.3 | Upgrade to 1.3.7.4. | |
ADDITIONAL PRODUCT INFORMATION
This vulnerability can be exploited only through the ASG and CA management interfaces. Symantec recommends that customers deploy the ASG and CA appliances in a secure network and restrict access to the management interface. Not deploying the appliance in a secure network or restricting management interface access increases the threat of exploiting the vulnerability.
ISSUES
| CVE-2016-9091 | |
|---|---|
| Severity / CVSSv2 | High / 7.7 (AV:A/AC:L/Au:S/C:C/I:C/A:C) |
| References | SecurityFocus: BID 97372 / NVD: CVE-2016-9091 |
| Impact | OS command injection |
| Severity | The ASG and CA management consoles are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with the privileges of the management console service. The malicious administrator can also elevate their privileges and execute OS commands with root privileges. |
MITIGATION
Symantec recommends that customers deploy the ASG and CA appliances in a secure network and restrict access to the management interface.
ACKNOWLEDGEMENTS
Thanks to Peter Paccione, Chris Hebert, and Corey Boyd for reporting this vulnerability.
REVISION
2019-01-17 Advisory Status moved to Closed.
2017-11-06 ASG 6.7 is not vulnerable.
2017-05-18 CAS 2.1 is not vulnerable.
2017-04-03 initial public release