CVE-2013-4673

The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 6.5 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/95702
http://www.securityfocus.com/bid/61105
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85990

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:symantec:web_gateway::::::::
	cpe:2.3:a:symantec:web_gateway:5.0:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.1:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.2:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.3:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.3.18:::::::*

OR	cpe:2.3:h:symantec:web_gateway_appliance_8450:-:::::::*
	cpe:2.3:h:symantec:web_gateway_appliance_8490:-:::::::*

History

No history.

Information

Published : 2013-08-01 13:32

Updated : 2024-02-28 12:00

NVD link : CVE-2013-4673

Mitre link : CVE-2013-4673

CVE.ORG link : CVE-2013-4673

JSON object : View

Products Affected

symantec

web_gateway
web_gateway_appliance_8450
web_gateway_appliance_8490

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2013-4673", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-08-01T13:32:21.410", "references": [{"url": "http://osvdb.org/95702", "source": "secure@symantec.com"}, {"url": "http://www.securityfocus.com/bid/61105", "source": "secure@symantec.com"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00", "tags": ["Vendor Advisory"], "source": "secure@symantec.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85990", "source": "secure@symantec.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt."}, {"lang": "es", "value": "La consola de gesti\u00f3n de Symantec Web Gateway (SWG) anterior a 5.1.1, no implementa la autenticaci\u00f3n RADIUS adecuadamente, lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario aprovechando el acceso al prompt del login."}], "lastModified": "2017-11-18T02:29:01.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:web_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B2BB75F-9AB3-4A27-993C-BD2077F4F3A9", "versionEndIncluding": "5.1"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F5B7857-75D5-4F77-81BF-7B55F743FD5F"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4525DE38-3B1F-490C-A772-BA0456FB6126"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3956706B-44B9-40BC-9AAB-78A9583A2858"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E5B2ABA-234A-43B1-8D91-33255F85AA26"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.3.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6286A061-2426-48A5-BCA2-CAB90D3B7406"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:symantec:web_gateway_appliance_8450:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4A72858-FBDC-4587-AC69-0BFA99031F92"}, {"criteria": "cpe:2.3:h:symantec:web_gateway_appliance_8490:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9149CE42-E9F2-4778-8E79-3E1960F813D3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secure@symantec.com"}