Severity
Medium
| Remote | Yes |
| Local | No |
| Authentication Required | Yes |
| Exploit publicly available | No |
Overview
A Cross Site Scripting Vulnerability and a denial of service vulnerability have been discovered in the Symantec Web Security (SWS) products.
Product(s) Affected
| Product | Version | Build | Platform |
| Symantec Web Security | 6.0 | All version prior to 3.0.1.85 | 3.0.1.85 |
Details
The SWS product fails to properly check and parse for URLs that may be embedded in HTML tags within error or blocked page messages returned to the client.
An attacker could potentially embed malicious scripts commands into certain specific URLs, which the client browser would execute in the context specified in the malicious command. The vulnerable HTML pages occur with SWS error and blocked pages. Cross-site scripting vulnerabilities are Web-based attacks that target execution via the browser used to connect to the Web server. The SWS Web-based management console failed to properly check and parse its own HTML tags within error and blocked page messages that are returned to the requesting client.
This type of attack requires additional input into the data stream by a malicious input, such as a Trojan horse which could issue commands or a URL may be generated that is outside the bounds of management. For example, it may specify unavailable links or be incorrectly formatted. The security gateway will reject this URL, but in so doing will return the offending URL to the browser without proper validation. The client browser, depending on configuration, may then act on the malicious content embedded in the URL. A denial of service vulnerability has also been identified. An unauthorized user can use the license registering interface and submit a very large file to Symantec Web Security. If the unauthorized user attempted to upload an extremely large file, the subsequent processing could slow the system creating a denial of service.
Symantec Response
Symantec has corrected this issue in Symantec Web Security 3.0.1.85 and has made an update available for download. The update is available here.
Credit
Symantec thanks Mikko Korppi, for finding and reporting these issues to Symantec.