A weakness and multiple vulnerabilities have been reported in Symantec Messaging Gateway, which can be exploited by malicious users to bypass certain security restrictions and disclose potentially sensitive information and by malicious people to disclose certain sensitive information and conduct cross-site scripting, request forgery, and script insertion attacks.

1) Certain input passed via web content is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session.

2) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. add an administrative user when a logged-in administrative user visits a specially crafted web page.

3) An error within the management interface can be exploited to perform otherwise restricted actions and e.g. modify the underlying web application.

4) The weakness is caused due to the application disclosing detailed component version information.

5) Certain input passed via email content is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

6) An unspecified error can be exploited to download arbitrary files.

This may be related to vulnerability #3.

The vulnerabilities are reported in versions 9.5.x and prior.

Solution
Upgrade to version 10.

Provided and/or discovered by
Ben Williams, NCC Group.

Changelog
Further details available to Secunia VIM customers

Original Advisory
SYM12-013:
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120827_00

NCC Group (NGS00263, NGS00265, NGS00266, NGS00268):
http://archives.neohapsis.com/archives/bugtraq/2012-11/0120.html
http://archives.neohapsis.com/archives/bugtraq/2012-11/0121.html
http://archives.neohapsis.com/archives/bugtraq/2012-11/0122.html
http://archives.neohapsis.com/archives/bugtraq/2012-11/0123.html

Deep Links
Links available to Secunia VIM customers