{"id": "VU:221620", "bulletinFamily": "info", "title": "Blue Coat ProxySG local user changes contain a time and state vulnerability", "description": "### Overview\n\nChanges to Blue Coat ProxySG local users do not take effect immediately, giving an attacker with known credentials a window of opportunity to use those credentials even if the user was deleted or the password was changed. ([CWE-361](<https://cwe.mitre.org/data/definitions/361.html>))\n\n### Description\n\n[Blue Coat Security Advisory SA77](<https://kb.bluecoat.com/index?page=content&id=SA77>) states: \n\n_SGOS supports multiple types of authentication realms for authenticating administrative and proxy users. Most authentication realms use remote authentication databases. Locally defined users and user lists are in the local authentication realm. The local authentication realm is typically used for administrative and console access, but can be used for proxy users as well._ \n \n_When local users change their password, are deleted, or are removed from or added to a user list, changes may take up to 15 minutes to take effect due to caching. If another password-related event (such as a correct login with the new password or a rejected login due to incorrect password) occurs, the time for changes to take effect may be shorter._ \n \n_An attacker who knows the account password can exploit this gap to gain unauthorized administrative access through the Management Console, or the SSH or serial console if the local realm is used for console access. A deleted user would continue to have network access for up to 15 minutes._ \n \nAdditional details may be found in the full [Blue Coat Security Advisory](<https://kb.bluecoat.com/index?page=content&id=SA77>). \n \n--- \n \n### Impact\n\nAn attacker with knowledge of existing credentials may be able to log in as that user even after the account was deleted. If the local realm is used for console access then the credentials may be used to compromise administrative access. \n \n--- \n \n### Solution\n\n**Apply an Update** \n \nApply the appropriate patch for the affected version in use. \n\n\n * ProxySG 6.5 \u2013 A fix is available in 6.5.4 and later. \n * ProxySG 6.4 \u2013 A fix is not yet available as of 6.4.6.1. \n * ProxySG 6.3 \u2013 Please upgrade to a later version. \n * ProxySG 6.2 \u2013 A fix is not yet available as of 6.2.15.3. \n * ProxySG 6.1 \u2013 A fix is not yet available as of 6.1.6.3. \n * ProxySG 5.5 \u2013 A fix is not yet available as of 5.5.11.3. \n * ProxySG 5.4 and earlier \u2013 Please upgrade to a later version.\n \nIf you are unable to upgrade, please consider the following workarounds. \n \n--- \n \nAfter changing a password, immediately log in with the new password or attempt to log in with an incorrect password. \n\n * After disabling an account, immediately attempt to use that account with an incorrect password. \n * Use non-local realm authentication types such as LDAP, certificate, and SAML. \n \n--- \n \n### Vendor Information \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nBlue Coat Systems| | -| 28 Feb 2014 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23221620 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | 7.4 | AV:A/AC:M/Au:S/C:C/I:C/A:C \nTemporal | 6.1 | E:F/RL:OF/RC:C \nEnvironmental | 4.6 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND \n \n### References\n\n * [https://kb.bluecoat.com/index?page=content&amp;id;=SA77](<https://kb.bluecoat.com/index?page=content&id=SA77>)\n * <https://cwe.mitre.org/data/definitions/361.html>\n\n### Credit\n\nThanks to Blue Coat for reporting this vulnerability.\n\nThis document was written by Jared Allar.\n\n### Other Information\n\n * CVE IDs: [CVE-2014-2033](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2033>)\n * Date Public: 21 Feb 2014\n * Date First Published: 28 Feb 2014\n * Date Last Updated: 28 Feb 2014\n * Document Revision: 7\n\n", "published": "2014-02-28T00:00:00", "modified": "2014-02-28T00:00:00", "cvss": {"score": 7.9, "vector": "AV:ADJACENT_NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.kb.cert.org/vuls/id/221620", "reporter": "CERT", "references": ["http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2033", "https://cwe.mitre.org/data/definitions/361.html", "https://cwe.mitre.org/data/definitions/361.html", "https://kb.bluecoat.com/index?page=content&id=SA77", "https://kb.bluecoat.com/index?page=content&id=SA77", "https://kb.bluecoat.com/index?page=content&id=SA77"], "cvelist": ["CVE-2014-2033", "CVE-2014-2033"], "type": "cert", "lastseen": "2018-08-02T21:56:40", "history": [{"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2014-2033", "CVE-2014-2033"], "cvss": {"score": 7.9, "vector": "AV:ADJACENT_NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "### Overview\n\nChanges to Blue Coat ProxySG local users do not take effect immediately, giving an attacker with known credentials a window of opportunity to use those credentials even if the user was deleted or the password was changed. ([CWE-361](<https://cwe.mitre.org/data/definitions/361.html>))\n\n### Description\n\n[Blue Coat Security Advisory SA77](<https://kb.bluecoat.com/index?page=content&id=SA77>) states: \n\n_SGOS supports multiple types of authentication realms for authenticating administrative and proxy users. Most authentication realms use remote authentication databases. Locally defined users and user lists are in the local authentication realm. The local authentication realm is typically used for administrative and console access, but can be used for proxy users as well._ \n \n_When local users change their password, are deleted, or are removed from or added to a user list, changes may take up to 15 minutes to take effect due to caching. If another password-related event (such as a correct login with the new password or a rejected login due to incorrect password) occurs, the time for changes to take effect may be shorter._ \n \n_An attacker who knows the account password can exploit this gap to gain unauthorized administrative access through the Management Console, or the SSH or serial console if the local realm is used for console access. A deleted user would continue to have network access for up to 15 minutes._ \n\n\nAdditional details may be found in the full [Blue Coat Security Advisory](<https://kb.bluecoat.com/index?page=content&id=SA77>). \n \n--- \n \n### Impact\n\nAn attacker with knowledge of existing credentials may be able to log in as that user even after the account was deleted. If the local realm is used for console access then the credentials may be used to compromise administrative access. \n \n--- \n \n### Solution\n\n**Apply an Update** \n \nApply the appropriate patch for the affected version in use. \n\n\n * ProxySG 6.5 \u2013 A fix is available in 6.5.4 and later. \n * ProxySG 6.4 \u2013 A fix is not yet available as of 6.4.6.1. \n * ProxySG 6.3 \u2013 Please upgrade to a later version. \n * ProxySG 6.2 \u2013 A fix is not yet available as of 6.2.15.3. \n * ProxySG 6.1 \u2013 A fix is not yet available as of 6.1.6.3. \n * ProxySG 5.5 \u2013 A fix is not yet available as of 5.5.11.3. \n * ProxySG 5.4 and earlier \u2013 Please upgrade to a later version.\n \nIf you are unable to upgrade, please consider the following workarounds. \n \n--- \n \nAfter changing a password, immediately log in with the new password or attempt to log in with an incorrect password. \n\n * After disabling an account, immediately attempt to use that account with an incorrect password. \n * Use non-local realm authentication types such as LDAP, certificate, and SAML. \n \n--- \n \n### Vendor Information \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nBlue Coat Systems| | -| 28 Feb 2014 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23221620 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | 7.4 | AV:A/AC:M/Au:S/C:C/I:C/A:C \nTemporal | 6.1 | E:F/RL:OF/RC:C \nEnvironmental | 4.6 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND \n \n### References\n\n * [https://kb.bluecoat.com/index?page=content&amp;id;=SA77](<https://kb.bluecoat.com/index?page=content&id=SA77>)\n * <https://cwe.mitre.org/data/definitions/361.html>\n\n### Credit\n\nThanks to Blue Coat for reporting this vulnerability.\n\nThis document was written by Jared Allar.\n\n### Other Information\n\n * CVE IDs: [CVE-2014-2033](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2033>)\n * Date Public: 21 Feb 2014\n * Date First Published: 28 Feb 2014\n * Date Last Updated: 28 Feb 2014\n * Document Revision: 7\n\n", "edition": 1, "enchantments": {"score": {"value": 7.2, "vector": "NONE"}}, "hash": "5455be1cb8d6c40e0fee18dca17a8a7582663b235e325f76a44e425219235574", "hashmap": [{"hash": "12ae3110ada8601d77a095ee217266b5", "key": "references"}, {"hash": "b6ba9fa6ea18201bf39ea635ecca9f13", "key": "type"}, {"hash": "d609eef03867c1db0f39b9abf6f59aac", "key": "description"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "3a7f029155d588d47171b26a491fdfc7", "key": "modified"}, {"hash": "8c2f76bbe736ed8a0c3b1b61088dc3fe", "key": "href"}, {"hash": "2694b0cc21d07cc824fb44bbd23c4eb2", "key": "cvelist"}, {"hash": "3be0dd8bea3f7543a1e713619f5ae0a3", "key": "title"}, {"hash": "3c82caeb23a004f44950519541cc09a1", "key": "cvss"}, {"hash": "3a7f029155d588d47171b26a491fdfc7", "key": "published"}, {"hash": "5d2cfab83ed6e86a4812690790dc7ad5", "key": "reporter"}], "history": [], "href": "https://www.kb.cert.org/vuls/id/221620", "id": "VU:221620", "lastseen": "2016-02-03T09:13:03", "modified": "2014-02-28T00:00:00", "objectVersion": "1.2", "published": "2014-02-28T00:00:00", "references": ["http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2033", "https://cwe.mitre.org/data/definitions/361.html", "https://cwe.mitre.org/data/definitions/361.html", "https://kb.bluecoat.com/index?page=content&id=SA77", "https://kb.bluecoat.com/index?page=content&id=SA77", "https://kb.bluecoat.com/index?page=content&id=SA77"], "reporter": "CERT", "title": "Blue Coat ProxySG local user changes contain a time and state vulnerability", "type": "cert", "viewCount": 1}, "differentElements": ["description"], "edition": 1, "lastseen": "2016-02-03T09:13:03"}], "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "caf9b6b99962bf5c2264824231d7a40c"}, {"key": "cvelist", "hash": "2694b0cc21d07cc824fb44bbd23c4eb2"}, {"key": "cvss", "hash": "3c82caeb23a004f44950519541cc09a1"}, {"key": "description", "hash": "acbf95d26f1d49a0767be8a9f370b7c5"}, {"key": "href", "hash": "8c2f76bbe736ed8a0c3b1b61088dc3fe"}, {"key": "modified", "hash": "3a7f029155d588d47171b26a491fdfc7"}, {"key": "published", "hash": "3a7f029155d588d47171b26a491fdfc7"}, {"key": "references", "hash": "12ae3110ada8601d77a095ee217266b5"}, {"key": "reporter", "hash": "5d2cfab83ed6e86a4812690790dc7ad5"}, {"key": "title", "hash": "3be0dd8bea3f7543a1e713619f5ae0a3"}, {"key": "type", "hash": "b6ba9fa6ea18201bf39ea635ecca9f13"}], "hash": "232ccb38ab83fe3f435e2728268d05e7709bce164c2033e7a1a6cfc8634a23a7", "viewCount": 1, "enchantments": {"score": {"value": 7.2, "vector": "NONE"}, "vulnersScore": 7.2}, "objectVersion": "1.3"}

{"result": {"cve": [{"lastseen": "2016-09-03T20:09:38", "references": ["http://www.kb.cert.org/vuls/id/221620", "https://kb.bluecoat.com/index?page=content&id=SA77"], "edition": 1, "description": "The caching feature in SGOS in Blue Coat ProxySG 5.5 through 5.5.11.3, 6.1 through 6.1.6.3, 6.2 through 6.2.15.3, 6.4 through 6.4.6.1, and 6.3 and 6.5 before 6.5.4 allows remote authenticated users to bypass intended access restrictions during a time window after account deletion or modification by leveraging knowledge of previously valid credentials.", "reporter": "NVD", "published": "2014-03-02T12:55:02", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "CVE-2014-2033", "type": "cve", "assessment": {"system": "", "name": "", "href": ""}, "bulletinFamily": "NVD", "cvelist": ["CVE-2014-2033"], "scanner": [], "modified": "2014-03-03T13:10:15", "cpe": ["cpe:/o:bluecoat:proxysgos:6.1.6.3", "cpe:/o:bluecoat:proxysgos:5.5", "cpe:/o:bluecoat:proxysgos:6.2", "cpe:/o:bluecoat:proxysgos:6.3", "cpe:/o:bluecoat:proxysgos:6.2.15.3", "cpe:/o:bluecoat:proxysgos:5.5.11", "cpe:/o:bluecoat:proxysgos:6.1", "cpe:/o:bluecoat:proxysgos:6.5", "cpe:/o:bluecoat:proxysgos:6.4.6.1", "cpe:/o:bluecoat:proxysgos:6.4"], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2033", "id": "CVE-2014-2033", "cvss": {"score": 7.9, "vector": "AV:ADJACENT_NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2018-06-29T05:54:45", "references": ["https://kb.bluecoat.com/index?page=content&id=SA77"], "pluginID": "72726", "description": "The remote Blue Coat ProxySG device's SGOS self-reported version is prior to 6.5.4.0. It is, therefore, potentially affected by a race condition issue during the time before the new changes take effect after a local user account modification due to configuration caching. User account modifications include password changes, user account deletion, or the addition or removal of a user account to a user list. \n\nNote that this issue only affects user accounts using local realm authentication.", "edition": 3, "reporter": "Tenable", "published": "2014-02-27T00:00:00", "title": "Blue Coat ProxySG Local User Modification Race Condition", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Firewalls", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-2033"], "modified": "2018-06-27T00:00:00", "cpe": ["cpe:/o:bluecoat:sgos"], "id": "BLUECOAT_PROXY_SG_6_5_4.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=72726", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(72726);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/06/27 18:42:25\");\n\n script_cve_id(\"CVE-2014-2033\");\n script_bugtraq_id(66054);\n script_xref(name:\"CERT\", value:\"221620\");\n\n script_name(english:\"Blue Coat ProxySG Local User Modification Race Condition\");\n script_summary(english:\"Checks the Blue Coat ProxySG SGOS version\");\n\n script_set_attribute(attribute:\"synopsis\", value:\"The remote device is potentially affected by a race condition issue.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Blue Coat ProxySG device's SGOS self-reported version is\nprior to 6.5.4.0. It is, therefore, potentially affected by a race\ncondition issue during the time before the new changes take effect after\na local user account modification due to configuration caching. User\naccount modifications include password changes, user account deletion,\nor the addition or removal of a user account to a user list. \n\nNote that this issue only affects user accounts using local realm\nauthentication.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://kb.bluecoat.com/index?page=content&id=SA77\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to version 6.5.4.0 or refer to the vendor.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:bluecoat:sgos\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/02/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/02/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/02/27\");\n\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Firewalls\");\n\n script_dependencies(\"bluecoat_proxy_sg_version.nasl\");\n script_require_keys(\"Host/BlueCoat/ProxySG/Version\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nversion = get_kb_item_or_exit(\"Host/BlueCoat/ProxySG/Version\");\nui_version = get_kb_item(\"Host/BlueCoat/ProxySG/UI_Version\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\nreport_fix = NULL;\n\n# Select version for report\nif (isnull(ui_version)) report_ver = version;\nelse report_ver = ui_version;\n\n\nif (version =~ \"^6\\.5\\.\" && ver_compare(ver:version, fix:\"6.5.4.0\", strict:FALSE) == -1)\n{\n fix = '6.5.4.0';\n ui_fix = '6.5.4.0 Build 0';\n\n # Select fixed version for report\n if (isnull(ui_version)) report_fix = fix;\n else report_fix = ui_fix;\n}\nelse if (\n version =~ \"^6\\.4\\.([0-5]\\.[0-9]+|6\\.[01])($|[^0-9])\" ||\n version =~ \"^6\\.2\\.((([0-9]|1[0-4])\\.[0-9]+)|15\\.[0-3])($|[^0-9])\" ||\n version =~ \"^6\\.1\\.(([0-5]\\.[0-9]+)|6\\.[0-3])($|[^0-9])\" ||\n version =~ \"^5\\.5\\.((([0-9]|10)\\.[0-9]+)|(11\\.[0-3]))($|[^0-9])\"\n) report_fix = \"A fix is not yet available.\";\nelse if (\n version =~ \"^6\\.3\\.\" ||\n version =~ \"^5\\.[0-4]\\.\" ||\n version =~ \"^[0-4]\\.\"\n) report_fix = \"Upgrade to a later version.\";\n\nif (report_fix)\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Installed version : ' + report_ver +\n '\\n Fixed version : ' + report_fix +\n '\\n';\n security_hole(port:0, extra:report);\n }\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_INST_VER_NOT_VULN, 'Blue Coat ProxySG', version);\n", "cvss": {"score": 7.9, "vector": "AV:ADJACENT_NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "seebug": [{"lastseen": "2017-11-19T17:31:26", "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"], "enchantments_done": [], "references": [], "description": "CVE ID:CVE-2014-2033\r\n\r\nBlue Coat ProxySG\u662f\u4e00\u6b3e\u4ee3\u7406\u8bbe\u5907\u5e73\u53f0\uff0c\u5e2e\u52a9\u4f01\u4e1a\u52a0\u901f\u548c\u4fdd\u62a4\u5206\u5e03\u5f0f\u7f51\u7edc\u4e2d\u7684\u5e94\u7528\u3002\r\n\r\nBlue Coat ProxySG SGOS\u4e2d\u7684\u7f13\u5b58\u529f\u80fd\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u901a\u8fc7\u9a8c\u8bc1\u7684\u7528\u6237\u5229\u7528\u4e4b\u524d\u5408\u6cd5\u7684\u8d26\u6237\u4fe1\u606f\uff0c\u5728\u8d26\u6237\u5220\u9664\u6216\u4fee\u6539\u65f6\u95f4\u7a97\u53e3\u4e2d\u7ed5\u8fc7\u8bbf\u95ee\u9650\u5236\uff0c\u672a\u6388\u6743\u8bbf\u95ee\u8bbe\u5907\u3002\n0\nBlue Coat ProxySG 5.5 - 5.5.11.3\r\nBlue Coat ProxySG 6.1 - 6.1.6.3\r\nBlue Coat ProxySG 6.2 - 6.2.15.3\r\nBlue Coat ProxySG 6.4 - 6.4.6.1\r\nBlue Coat ProxySG 6.3\r\nBlue Coat ProxySG 6.5\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nBlue Coat ProxySG\r\n-----\r\n\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttps://kb.bluecoat.com/index?page=content&amp;id=SA77", "reporter": "Root", "published": "2014-03-07T00:00:00", "title": "Blue Coat ProxySG\u8bbf\u95ee\u9650\u5236\u7ed5\u8fc7\u6f0f\u6d1e", "type": "seebug", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2014-2033"], "_object_type": "robots.models.seebug.SeebugBulletin", "modified": "2014-03-07T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-61691", "id": "SSV:61691", "sourceData": "", "cvss": {"score": 7.9, "vector": "AV:ADJACENT_NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "", "status": "details"}]}}