AusCERT - ASB-2012.0008 - [Win] Bluecoat IntelligenceCenter: Multiple vulnerabilities

HOME

About AusCERT

Membership

PKI Services

Training

Publications

Sec. Bulletins

Conferences

News & Media

Services

Web Log

Site Map

Site Help

Member login

ASB-2012.0008 - [Win] Bluecoat IntelligenceCenter: Multiple vulnerabilities

Date: 13 January 2012
References: ESB-2009.0535  ESB-2009.0559  ASB-2009.1083.2  ASB-2009.1158  ESB-2010.0395  ASB-2010.0126  ESB-2010.0466  ESB-2010.0604  ESB-2010.0891  ESB-2010.1064
ESB-2011.0113  ESB-2011.0119  ESB-2011.0673  ASB-2011.0064.2  ESB-2011.0975  ESB-2012.0073  ESB-2012.0102  ESB-2012.0103  ESB-2012.0116  ESB-2012.0132  ESB-2012.0383
ESB-2012.0423

Click here for printable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0008
Multiple Tomcat and PostgreSQL vulnerabilities fixed in IntelligenceCenter
                              13 January 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Bluecoat IntelligenceCenter
Operating System:     Windows Server 2003
                      Windows Server 2008
Impact/Access:        Increased Privileges            -- Remote/Unauthenticated      
                      Access Privileged Data          -- Remote/Unauthenticated      
                      Execute Arbitrary Code/Commands -- Existing Account            
                      Modify Arbitrary Files          -- Existing Account            
                      Denial of Service               -- Remote/Unauthenticated      
                      Cross-site Scripting            -- Remote with User Interaction
                      Unauthorised Access             -- Existing Account            
Resolution:           Patch/Upgrade
CVE Names:            CVE-2011-2729 CVE-2011-2204 CVE-2011-1184
                      CVE-2011-0013 CVE-2010-4172 CVE-2010-4015
                      CVE-2010-3718 CVE-2010-3433 CVE-2010-2227
                      CVE-2010-1975 CVE-2010-1170 CVE-2010-1169
                      CVE-2010-1157 CVE-2009-4136 CVE-2009-4034
                      CVE-2009-3230 CVE-2009-3229 CVE-2009-0783
                      CVE-2008-5515  
Member content until: Sunday, February 12 2012
Reference:            ESB-2011.0975
                      ESB-2011.0673
                      ESB-2011.0119
                      ESB-2011.0113
                      ASB-2010.0126
                      ESB-2010.1064
                      ESB-2010.0891
                      ESB-2010.0604
                      ESB-2010.0466
                      ESB-2010.0395
                      ASB-2009.1158
                      ESB-2009.0559
                      ESB-2009.0535
                      ASB-2011.0064.2
                      ASB-2009.1083.2

OVERVIEW

        A number of publicly documented Tomcat and PostgreSQL
        vulnerabilities have been fixed in IntelligenceCenter 3.2.2.1.


IMPACT

        Bluecoat has provided the following information about the Tomcat
        vulnerabilities:
        
        "The most severe vulnerability allows an attacker to read data that
        Tomcat is authorized to access allowing the attacker to view specific
        configuration data and data sent to and from IntelligenceCenter. The
        attacker can also mount a denial of service attack using a specially
        crafted header rendering IntelligenceCenter partially unresponsive for
        administrative control as well as data transmission." [1]
        
        The following are details of the PostgreSQL vulnerabilities:
        
        "The most severe vulnerability allows an attacker to gain complete
        control over an IntelligenceCenter installation. The attacker can view
        and modify configuration data as well as data sent to and from
        IntelligenceCenter. An attacker can also render IntelligenceCenter
        completely unresponsive for administrative control as well as data
        transmission." [2]


MITIGATION

        Upgrading to 3.2.2.1 will fix the issue. [1][2]
        
        Bluecoat has also provided the following additional recommendations:
        
        "Blue Coat recommends that IntelligenceCenter be deployed behind a
        firewall. Additional constraints on what IP addresses can be used to
        connect to IntelligenceCenter will greatly limit the ability to
        attack an IntelligenceCenter installation." [1][2]


REFERENCES

        [1] Multiple Tomcat vulnerabilities in IntelligenceCenter
            https://kb.bluecoat.com/index?page=content&id=SA66

        [2] Multiple PostgreSQL vulnerabilities in IntelligenceCenter
            https://kb.bluecoat.com/index?page=content&id=SA67

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTw+z2O4yVqjM2NGpAQJuEQ//SLjR7M91RVTvBt0C29SBEgfcWPYkxnmB
NXOrlGSbXhFQg29xKUCtXaBKyTmpNeUKMMH+z03gI3hD8IDg/KnPIA88HLNyGegM
n00kikHR1mRvU19LqmmuA+xKkOGMmLKZh4NvzwYwvu+R3+5ePuPSyYP6Ony8wIuG
U9rm8CAhhAo4fOq+SXZmrIGlaBK4RkRyx+m5LuWB12VudPEPxvWAf2D0cV0Tt3CE
ENbEBxeJ/XcBcebSHpO/BRZDbGKUeksRx9wJZv7Vz02G8pzLY511HKEKTFzcZad2
PTN+DNmtFVG7fTzv/xUZ6iuOtKpd2dB69BKzFE/hMK4+LT3jwJKh/9mi1FZ+O2RP
HOolMWIje/Hvdd6MjkvBYqDA6AyaTg/mm9NCciVbvs11YT02JDEMeuFJxOGmtbY+
CATtFoRCZ6YQoP6P5wQotF8toCR6mOwsW2F8Qi/yFRk5nJqfoi70hMZHbiB8NM+N
ePCIZOIAXYie3zcVfxRBdbhGcsUUFY6/84h8RdikUsCRtrvXSo+3s6t5onOHG99e
219hwnFJow+CW04IIJCWnPI6EZ4QPAxy4sIHUPLsOcH75l/Az3Q6WPQ3yR9uEZmg
gVMEhTf+2Tpfy0FJ9lXVVcf/ESyBD56ax/63XhFfDuDhibN7bOBU+G0q1EPipOpQ
jpkZRTPTwaM=
=pPdp
-----END PGP SIGNATURE-----