Details of VAR-201705-3126

ID

VAR-201705-3126

CVE

CVE-2016-9097

TITLE

Broadcom of advanced secure gateway and symantec proxysg Vulnerabilities related to authorization, privileges, and access control in

Trust: 0.8

sources: JVNDB: JVNDB-2016-009738

DESCRIPTION

The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges. Broadcom of advanced secure gateway and symantec proxysg contains vulnerabilities related to authorization, privileges, and access control.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. ProxySG and ASG are prone to an authorization-bypass vulnerability. Attackers can exploit this issue to gain unauthorized access and obtain sensitive information or elevate privileges. This may aid in further attacks. The following products are affected: Blue Coat Systems ASG 6.6 prior to 6.6.5.8 is vulnerable. Blue Coat Systems ProxySG 6.5 prior to 6.5.10.6, 6.6 prior to 6.6.5.8, and 6.7 prior to 6.7.1.2 are vulnerable. Symantec ProxySG and Advanced Secure Gateway (ASG) are security gateway devices of Symantec Corporation of the United States. Security vulnerabilities exist in Symantec ProxySG and ASG

Trust: 1.98

sources: NVD: CVE-2016-9097 // JVNDB: JVNDB-2016-009738 // BID: 101530 // VULHUB: VHN-97917

AFFECTED PRODUCTS

vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.5.7	Trust: 1.0
vendor:	broadcom	model:	advanced secure gateway	scope:	eq	version:	6.6.5.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.3	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.6.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.2.2	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.4.3	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.9.2	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.2	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.9.14	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.9.10	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6	Trust: 1.0
vendor:	broadcom	model:	advanced secure gateway	scope:	eq	version:	6.6.4	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.2.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.3.2	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.7	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.4.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.7.6	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.9.8	Trust: 1.0
vendor:	broadcom	model:	advanced secure gateway	scope:	eq	version:	6.6.3	Trust: 1.0
vendor:	broadcom	model:	advanced secure gateway	scope:	eq	version:	6.6.4.3	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.7.1.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.5	Trust: 1.0
vendor:	broadcom	model:	advanced secure gateway	scope:	eq	version:	6.6	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.2.10	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.5.4.1	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.2	Trust: 1.0
vendor:	broadcom	model:	symantec proxysg	scope:	eq	version:	6.6.4	Trust: 1.0
vendor:	broadcom	model:	advanced secure gateway	scope:	-	version:	-	Trust: 0.8
vendor:	broadcom	model:	symantec proxysg	scope:	-	version:	-	Trust: 0.8
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.5	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.4.1	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.7	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.7.1.1	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.2.2	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.3.2	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.3	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.4.3	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.4	Trust: 0.6
vendor:	symantec	model:	proxysg	scope:	eq	version:	6.6.2.1	Trust: 0.6
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.4	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.36	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.35	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.7	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.6	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.8.8	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.7.3	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.5.7	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.5.4	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5.1.1	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	eq	version:	6.5	Trust: 0.3
vendor:	blue	model:	coat systems advanced secure gateway	scope:	eq	version:	6.6	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	ne	version:	6.7.1.2	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	ne	version:	6.6.5.8	Trust: 0.3
vendor:	blue	model:	coat systems proxysg	scope:	ne	version:	6.5.10.6	Trust: 0.3
vendor:	blue	model:	coat systems advanced secure gateway	scope:	ne	version:	6.6.5.8	Trust: 0.3

sources: BID: 101530 // JVNDB: JVNDB-2016-009738 // CNNVD: CNNVD-201710-1277 // NVD: CVE-2016-9097

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-9097
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-9097
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201710-1277
value:	HIGH
Trust: 0.6
VULHUB:	VHN-97917
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-9097
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-97917
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-9097
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-97917 // JVNDB: JVNDB-2016-009738 // CNNVD: CNNVD-201710-1277 // NVD: CVE-2016-9097

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.1
problemtype:	Authorization / authority / access control (CWE-264) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-97917 // JVNDB: JVNDB-2016-009738 // NVD: CVE-2016-9097

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201710-1277

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201710-1277

PATCH

title:

Symantec ProxySG and Advanced Secure Gateway Security vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155178

Trust: 0.6

sources: CNNVD: CNNVD-201710-1277

EXTERNAL IDS

db:	NVD	id:	CVE-2016-9097	Trust: 3.6
db:	BID	id:	101530	Trust: 2.8
db:	SECTRACK	id:	1039701	Trust: 2.5
db:	JVNDB	id:	JVNDB-2016-009738	Trust: 0.8
db:	CNNVD	id:	CNNVD-201710-1277	Trust: 0.7
db:	VULHUB	id:	VHN-97917	Trust: 0.1

sources: VULHUB: VHN-97917 // BID: 101530 // JVNDB: JVNDB-2016-009738 // CNNVD: CNNVD-201710-1277 // NVD: CVE-2016-9097

REFERENCES

url:	https://www.symantec.com/security-center/network-protection-security-advisories/sa146	Trust: 2.8
url:	http://www.securityfocus.com/bid/101530	Trust: 2.5
url:	http://www.securitytracker.com/id/1039701	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9097	Trust: 0.8
url:	http://www.bluecoat.com/products/sg	Trust: 0.3
url:	https://www.bluecoat.com/	Trust: 0.3

sources: VULHUB: VHN-97917 // BID: 101530 // JVNDB: JVNDB-2016-009738 // CNNVD: CNNVD-201710-1277 // NVD: CVE-2016-9097

CREDITS

Jakub Palaczynski and Pawel Bartunek.

Trust: 0.9

sources: BID: 101530 // CNNVD: CNNVD-201710-1277

SOURCES

db:	VULHUB	id:	VHN-97917
db:	BID	id:	101530
db:	JVNDB	id:	JVNDB-2016-009738
db:	CNNVD	id:	CNNVD-201710-1277
db:	NVD	id:	CVE-2016-9097

LAST UPDATE DATE

2024-11-23T23:05:27.022000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-97917	date:	2021-07-08T00:00:00
db:	BID	id:	101530	date:	2017-12-19T20:00:00
db:	JVNDB	id:	JVNDB-2016-009738	date:	2024-07-18T07:31:00
db:	CNNVD	id:	CNNVD-201710-1277	date:	2021-06-28T00:00:00
db:	NVD	id:	CVE-2016-9097	date:	2024-11-21T03:00:35.517

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-97917	date:	2017-05-11T00:00:00
db:	BID	id:	101530	date:	2017-10-26T00:00:00
db:	JVNDB	id:	JVNDB-2016-009738	date:	2024-07-18T00:00:00
db:	CNNVD	id:	CNNVD-201710-1277	date:	2017-10-26T00:00:00
db:	NVD	id:	CVE-2016-9097	date:	2017-05-11T14:30:16.360