CVE-2015-4334 : The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwa

The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upstream origin content servers (OCS) when used in an explicit proxy deployment, which makes it easier for remote attackers to obtain sensitive information via a 407 (aka Proxy Authentication Required) HTTP status code, as demonstrated when using NTLM authentication.

Published 2015-12-07 20:59:06

Updated 2019-02-12 19:10:36

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2015-4334

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-4334

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

References for CVE-2015-4334

http://www.securitytracker.com/id/1032149

Blue Coat ProxySG Discloses NTLM Hashes to Remote Users - SecurityTracker
Third Party Advisory;VDB Entry
https://bto.bluecoat.com/security-advisory/sa93

SA93 : HTTP Authentication Challenges Forwarded by ProxySG (by default)
Vendor Advisory
https://twitter.com/bugch3ck/status/591492380294979585

Jonas Vestberg on Twitter: "Updated security advisory from @BlueCoat https://t.co/TIS4O4UEt6 (and new title). They got a few things wrong:"
Third Party Advisory

Products affected by CVE-2015-4334

Symantec » Proxysg Firmware
Versions from including (>=) 6.2 and up to, including, (<=) 6.2.16.4
cpe:2.3:o:symantec:proxysg_firmware:*:*:*:*:*:*:*:*
Matching versions
Symantec » Proxysg Firmware
Versions from including (>=) 6.6 and up to, including, (<=) 6.6.2.0
cpe:2.3:o:symantec:proxysg_firmware:*:*:*:*:*:*:*:*
Matching versions
Symantec » Proxysg Firmware
Versions from including (>=) 6.5 and up to, including, (<=) 6.5.7.0
cpe:2.3:o:symantec:proxysg_firmware:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2015-4334

Exploit prediction scoring system (EPSS) score for CVE-2015-4334

CVSS scores for CVE-2015-4334

CWE ids for CVE-2015-4334

References for CVE-2015-4334

Products affected by CVE-2015-4334