Multiple vulnerabilities have been reported in Symantec Web Gateway, which can be exploited by malicious people to bypass certain security restrictions, disclose potentially sensitive information, conduct SQL injection attacks, and compromise a vulnerable system.

1) The application improperly validates input passed via the "filename" parameter to spywall/pbcontrol.php and can be exploited to inject and execute arbitrary shell commands.

2) Input passed via the "language" parameter to spywall/languageTest.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL encoded NULL bytes.

Successful exploitation of this vulnerability allows execution of arbitrary code.

3) Certain unspecified input passed to the management console is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) The application improperly validates certain input to multiple scripts via the management console and can be exploited to e.g. inject arbitrary shell commands.

5) The application improperly validates certain input via the management console and can be exploited to change the password of an arbitrary user of the application.

6) Input passed via the "ip" parameter to spywall/ldap_latest.php and to spywall/blocked.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are reported in versions 5.0.3.18 and prior, prior to Database Update 5.0.0.438.

Solution
Apply Database Update 5.0.0.438.

Provided and/or discovered by
1, 2, 6) muts, Offensive Security via US-CERT
2 - 5) Tenable Network Security via US-CERT

Changelog
Further details available to Secunia VIM customers

Original Advisory
SYM12-011:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120720_00

muts:
http://www.exploit-db.com/exploits/20038/
http://www.exploit-db.com/exploits/20044/
http://www.exploit-db.com/exploits/20064/
http://www.exploit-db.com/exploits/20088/

CERT:
http://www.kb.cert.org/vuls/id/108471

Deep Links
Links available to Secunia VIM customers