CVE-2016-9097
Summary
| CVE | CVE-2016-9097 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-05-11 14:30:00 UTC |
| Updated | 2021-07-08 16:37:00 UTC |
| Description | The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Broadcom | Advanced Secure Gateway | 6.6 | All | All | All |
| Application | Broadcom | Advanced Secure Gateway | 6.6.3 | All | All | All |
| Application | Broadcom | Advanced Secure Gateway | 6.6.4 | All | All | All |
| Application | Broadcom | Advanced Secure Gateway | 6.6.4.3 | All | All | All |
| Application | Broadcom | Advanced Secure Gateway | 6.6.5.1 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.1 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.2 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.2.10 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.4.1 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.5.7 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.6.1 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.7.6 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.9.10 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.9.14 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.9.2 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.5.9.8 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.2 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.2.1 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.2.2 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.3 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.3.2 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.4 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.4.1 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.4.3 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.6.5 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.7 | All | All | All |
| Application | Broadcom | Symantec Proxysg | 6.7.1.1 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.3 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.4 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.4.3 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.5.1 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.3 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.4 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.4.3 | All | All | All |
| Application | Symantec | Advanced Secure Gateway | 6.6.5.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5 | All | All | All |
| Application | Symantec | Proxysg | 6.5.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5.2 | All | All | All |
| Application | Symantec | Proxysg | 6.5.2.10 | All | All | All |
| Application | Symantec | Proxysg | 6.5.4.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5.5.7 | All | All | All |
| Application | Symantec | Proxysg | 6.5.6.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5.7.6 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.10 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.14 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.2 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.8 | All | All | All |
| Application | Symantec | Proxysg | 6.6 | All | All | All |
| Application | Symantec | Proxysg | 6.6.2 | All | All | All |
| Application | Symantec | Proxysg | 6.6.2.1 | All | All | All |
| Application | Symantec | Proxysg | 6.6.2.2 | All | All | All |
| Application | Symantec | Proxysg | 6.6.3 | All | All | All |
| Application | Symantec | Proxysg | 6.6.3.2 | All | All | All |
| Application | Symantec | Proxysg | 6.6.4 | All | All | All |
| Application | Symantec | Proxysg | 6.6.4.1 | All | All | All |
| Application | Symantec | Proxysg | 6.6.4.3 | All | All | All |
| Application | Symantec | Proxysg | 6.6.5 | All | All | All |
| Application | Symantec | Proxysg | 6.7 | All | All | All |
| Application | Symantec | Proxysg | 6.7.1.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5 | All | All | All |
| Application | Symantec | Proxysg | 6.5.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5.2 | All | All | All |
| Application | Symantec | Proxysg | 6.5.2.10 | All | All | All |
| Application | Symantec | Proxysg | 6.5.4.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5.5.7 | All | All | All |
| Application | Symantec | Proxysg | 6.5.6.1 | All | All | All |
| Application | Symantec | Proxysg | 6.5.7.6 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.10 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.14 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.2 | All | All | All |
| Application | Symantec | Proxysg | 6.5.9.8 | All | All | All |
| Application | Symantec | Proxysg | 6.6 | All | All | All |
| Application | Symantec | Proxysg | 6.6.2 | All | All | All |
| Application | Symantec | Proxysg | 6.6.2.1 | All | All | All |
| Application | Symantec | Proxysg | 6.6.2.2 | All | All | All |
| Application | Symantec | Proxysg | 6.6.3 | All | All | All |
| Application | Symantec | Proxysg | 6.6.3.2 | All | All | All |
| Application | Symantec | Proxysg | 6.6.4 | All | All | All |
| Application | Symantec | Proxysg | 6.6.4.1 | All | All | All |
| Application | Symantec | Proxysg | 6.6.4.3 | All | All | All |
| Application | Symantec | Proxysg | 6.6.5 | All | All | All |
| Application | Symantec | Proxysg | 6.7 | All | All | All |
| Application | Symantec | Proxysg | 6.7.1.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Blue Coat ProxySG Lets Remote Authenticated Users Gain Elevated Privileges - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| ProxySG and ASG CVE-2016-9097 Remote Authorization Bypass Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| SA146: Improper User Authorization in ProxySG and ASG | CONFIRM | www.symantec.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.