Cyberoam generates fix for 'nullified' vulnerability

Powered by SC Magazine
 

Generates unique certificates.

Security vendor Cyberoam has issued a hotfix for a interception vulnerability it downplayed this week. 

The fix replaces generic certificates within Cyberoam Unified Threat Management (UTM) devices with unique ones.This squashes the possibility that the Deep Packet Inspection (DPI) modules could intercept traffic from users assigned to different Cyberoam UTM boxes.

Tor security researcher Runa Sandvik and OpenDNS’ Ben Laurie discovered the that units used shared certificates which users must accept to have their encrypted traffic scanned, ostensibly for security threats.

Users accepting the certificates could be scanned by any Cyberoam DPI unit, researchers said.

Cyberoam refuted the allegations along with suggestions by the researchers that private keys could be extracted from the devices.

"Cyberoam UTM either accepts or rejects, but does not store HTTPS Deep Scan Inspection data, as processing is done in real-time. The possibility of data interception between any two Cyberoam appliances is hence nullified," the company said on its blog.

“.. theoretically it is possible to decrypt SSL data using a conned private key. Cyberoam UTM does not allow import or export of the foresaid private key used for the SSL-Bridging technology.”

The fix generates a positive alert when it has been successfully applied.

Copyright © SC Magazine, Australia


Cyberoam generates fix for 'nullified' vulnerability
Via Flickr
 
 
 
Top Stories
First look: Microsoft Outlook for iOS
[Update] Office productivity suite for iOS completed with Outlook.
 
NewSat defaults on $26m in overdue Lockheed payments
Jabiru-1 satellite build hits further hurdles.
 
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
 
Via Flickr
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3096

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 986

Vote