SUMMARY

Blue Coat products that include vulnerable versions of OpenSSH and enable X11 forwarding are susceptible to a command injection vulnerability due to insufficient input data sanitization.  An authenticated remote attacker can exploit this vulnerability to bypass intended command restrictions enforced by a restricted shell or the target's SSH configuration.  The attacker can also execute arbitrary commands.

AFFECTED PRODUCTS

 The following products contain a vulnerable version of OpenSSH, but are not vulnerable to known vectors of attack:

ADDITIONAL PRODUCT INFORMATION

ISSUES

This Security Advisory addresses a shell command restriction bypass vulnerability when X11 forwarding is enabled in OpenSSH server (CVE-2016-3115).  Blue Coat products that include a vulnerable version of OpenSSH and use the affected functionality are vulnerable.

When establishing an X11 forwarding session, the SSH client sends an X11 authentication credential to the SSH server.  The credential consists of an authentication scheme and credential data.  The SSH server passes the credential components as command line arguments to the xauth utility, which stores them in an X11 authorization file.  Affected versions of OpenSSH do not sufficiently sanitize the credential components before invoking xauth with them.  A remote attacker can exploit this vulnerability by acting as an SSH client and sending crafted credential components to inject arbitrary commands in xauth.  The attacker can use xauth commands to read and overwrite arbitrary files, connect to local ports on the target, and perform attacks against xauth.

REFERENCES

OpenSSH security advisory - https://www.openssh.com/txt/x11fwd.adv

REVISION

2020-04-21 Advisory status changes to Closed.
2019-10-02 Web Isolation is not vulnerable.
2018-07-01 A fix for PacketShaper 9.2 is available in 9.2.13p7.
2018-04-22 PacketShaper S-Series 11.10 is not vulnerable.
2017-11-06 ASG 6.7 is not vulnerable because a fix is available in 6.7.2.1.
2017-08-02 SSLV 4.1 is not vulnerable.
2017-07-24 PacketShaper S-Series 11.9 is not vulnerable.
2017-07-20 MC 1.10 is not vulnerable.
2017-06-22 Security Analytics 7.3 is not vulnerable.
2017-06-05 PacketShaper S-Series 11.8 is not vulnerable.
2017-05-29 SSLV 4.0 is not vulnerable.
2017-05-18 CAS 2.1 is not vulnerable.
2017-04-30 A fix for Director 6.1 is available in 6.1.23.1.
2017-03-30 MC 1.9 is not vulnerable.
2017-03-06 MC 1.8 is not vulnerable.  Vulnerability inquiries for DLP should be addressed to Digital Guardian technical support.
2016-12-04 PacketShaper S-Series 11.7 is not vulnerable.
2016-12-04 SSLV 3.11 is not vulnerable.
2016-11-17 Cloud Data Protection for Oracle Field Service Cloud is not vulnerable.
2016-11-11 SSLV 3.10 is not vulnerable.
2016-10-26 A fix for ASG is available in 6.6.5.1.  A fix for MAA is available in 4.2.10.  A fix for Reporter 10.1 is available in 10.1.4.2.  A fix for MC 1.6 is available in 1.6.1.1.  MC 1.7 is not vulnerable.  A fix for MC 1.5 will not be provided.
2016-08-12 A fix for CAS 1.3 is available in 1.3.7.1.  Security Analytics 7.2 is not vulnerable.
2016-08-10 A fix for SSLV 3.9 is available in 3.9.4.1.
2016-06-30 PacketShaper S-Series 11.6 is not vulnerable.
2016-06-24 A fix for PacketShaper S-Series is available in 11.5.3.2.  A fix for PolicyCenter S-Series is available in 1.1.2.2.
2016-06-16 PS S-Series 11.2, 11.3, 11.4, and 11.5 have a vulnerable version of OpenSSH, but are not vulnerable to known vectors of attack.  PC S-Series 1.1 has a vulnerable version of OpenSSH, but is not vulnerable to known vectors of attack.  Fixes are not available at this time.
2016-06-13 Fixes for ICSP, NNP, and NSP are available in 5.3.6.
2016-05-26 Fixes are available for Security Analytics 6.6 and 7.1 through patch RPMs from Blue Coat Support.
2016-05-11 No Cloud Data Protection products are vulnerable.
2016-04-28 initial public release