Symantec Gateway Security Management Service Cross Site Scripting

Brian_J_Soby_at_raytheon.com
Date: 02/27/04

  • Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-04:03.jail" 
    To: bugtraq@securityfocus.com
Date: Fri, 27 Feb 2004 11:12:53 -0500

    Symantec Gateway Security Management Service Cross Site Scripting

    Product: Symantec Gateway Security 2.0
    Date: 02/25/2004
    Author: Brian Soby, Raytheon

    1. Overview
    ----------------------------------------
    A cross site scripting vulnerability exists in Symantec Gateway Security's
    management service which could allow an attacker to hijack a management
    session to the device.

    2. Vulnerability Description
    ----------------------------------------
    A vulnerability exists in the Symantec Gateway Security management server
    object's handling of URLs when including them in error pages displayed to
    the requesting client. No parsing is done to the URLs to ensure that HTML
    tags are not included and returned to the client.

    3. Conditions
    ---------------------------------------
    The URL requested by the client must be handled by the Symantec Gateway
    Security's custom server object. For example, any request for an object
    under the /sgmi directory is passed to the Symantec Gateway Security
    server object for processing. The attacker could present a URL in the form
    of https://FirewallHostname:2456/sgmi/>badscript</script> to the
    client. SGS would display the URL back to the client, usually in a 404
    page or other error page, causing the execution of the script "badscript"
    in the context of the SGS device.

    4. Impact
    --------------------------------------
    Malicious script can be executed in the context of a trusted device,
    authentication cookies can be stolen (including JSESSIONID cookie used to
    authenticate a management session), etc. Because no access control policy
    restricts the access to the management service by default, an attacker who
    is able to obtain the JSESSIONID cookie for a valid session could connect
    from an untrusted network and assume management rights of the device.

    5. Solution
    --------------------------------------
    Symantec has released a patch that addresses this issue. It is available
    at
    http://www.symantec.com/techsupp/enterprise/products/sym_gateway_security/sym_gw_security_2_5400/files.html
    under hotfix ID SG8000-20040130-00. This problem is described in the
    hotfix readme as a fix that "Changes the return page when management URL
    is requested incorrectly"

    6. Disclaimer
    --------------------------------------
    The information in this advisory is believed to be accurate at the time of
    publishing based on currently available information. Use of the
    information constitutes acceptance for use in an AS IS condition. There
    are no warranties, expressed or implied, with regard to this information.
    In no event shall the author be liable for any damages whatsoever arising
    out of or in connection with this information.

    7. Copyright
    --------------------------------------
    Copyright (c) 2004 Raytheon. Permission is hereby granted to redistribute
    this alert electronically, provided it is left whole and not modified in
    any way.

  • Next message: FreeBSD Security Advisories: "FreeBSD Security Advisory FreeBSD-SA-04:03.jail"