Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
BID:66734
Info
Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
| Bugtraq ID: | 66734 |
| Class: | Design Error |
| CVE: |
CVE-2014-2849 CVE-2014-2850 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2014 12:00AM |
| Updated: | Apr 17 2014 01:09AM |
| Credit: | Brandon Perry |
| Vulnerable: |
Sophos Web Appliance 3.0 |
| Not Vulnerable: | |
Discussion
Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
Sophos Web Appliance is prone to a privilege-escalation vulnerability and remote code-execution vulnerability.
Attackers can leverage these issues to gain root privileges and execute arbitrary code. Successfully exploiting these issues will result in the complete compromise of affected computers.
Versions prior to Sophos Web Appliance 3.8.2 are vulnerable.
Sophos Web Appliance is prone to a privilege-escalation vulnerability and remote code-execution vulnerability.
Attackers can leverage these issues to gain root privileges and execute arbitrary code. Successfully exploiting these issues will result in the complete compromise of affected computers.
Versions prior to Sophos Web Appliance 3.8.2 are vulnerable.
Exploit / POC
Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
The following metasploit module is available:
The following metasploit module is available:
Solution / Fix
Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerabilities
References:
References: