Blue Coat has released a security advisory for SSL Visibility Appliance. The SSL Visibility Appliance is susceptible to multiple web-based vulnerabilities in the administration console. A remote attacker can use these vulnerabilities to obtain administrative access to the SSL Visibility Appliance. All versions of SSL Visibility prior to 3.8.4 are vulnerable.

The vulnerabilities exist in the WebUI are: 

• Cross-Site Request Forgery (CVE-2015-2852): Cross-site request forgery (CSRF) vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack the authentication of administrators.

• Clickjacking due to improper input validation (CVE-2015-2854): The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element.

• Cookie theft (CVE-2015-2855): The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.

• Session fixation.(CVE-2015-2853): Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID.

Workarounds:

Limit access to the SSL Visibility management port to trusted clients with limited access to the outside internet.  SSLV can be configured to limit the IP addresses capable of accessing the management port.

Limit administrative capabilities by assigning distinct roles for different types of administrators.

Use ProxySG and WebPulse to block access to malicious websites from clients.

Patches: 

SSL Visibility
SSLV 3.8 – a fix is available in 3.8.4.
SSLV 3.8.2f – a fix will not be provided.  Please upgrade to the latest release with the vulnerability fix.
SSLV 3.7.4 – a fix will not be provided.  Please upgrade to the latest release with the vulnerability fix.

For further details:

1. https://bto.bluecoat.com/security-advisory/sa96
2. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2852
3. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2853
4. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2854
5. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2855