PT-2014-4439 · Blue Coat · Blue Coat Proxysg

Published 2014-03-02 · Updated 2018-12-12 · CVE-2014-2033

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Blue Coat ProxySG versions 5.5 through 5.5.11.3 Blue Coat ProxySG versions 6.1 through 6.1.6.3 Blue Coat ProxySG versions 6.2 through 6.2.15.3 Blue Coat ProxySG versions 6.4 through 6.4.6.1 Blue Coat ProxySG version 6.3 Blue Coat ProxySG versions 6.5 before 6.5.4

Description The caching feature in SGOS allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials.

Recommendations For Blue Coat ProxySG versions 5.5 through 5.5.11.3, update to a version after 5.5.11.3 to resolve the issue. For Blue Coat ProxySG versions 6.1 through 6.1.6.3, update to a version after 6.1.6.3 to resolve the issue. For Blue Coat ProxySG versions 6.2 through 6.2.15.3, update to a version after 6.2.15.3 to resolve the issue. For Blue Coat ProxySG versions 6.4 through 6.4.6.1, update to a version after 6.4.6.1 to resolve the issue. For Blue Coat ProxySG version 6.3, update to version 6.5.4 or later to resolve the issue. For Blue Coat ProxySG versions 6.5 before 6.5.4, update to version 6.5.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-2033

Affected Products

Blue Coat Proxysg

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-2033 · Security Note
• https://kb.bluecoat.com/index?page=content&id=SA77 · Vendor Advisory
• http://kb.cert.org/vuls/id/221620 · Note