Sophos Web Security and Control 在网关处阻止网页数据流中的恶意程序、间谍软件、钓鱼，匿名代理和其他流氓程序。
Web Protection Appliance 3.7.8.2及之前版本存在任意文件泄露漏洞，攻击者可利用这些漏洞泄露设备上下文内的任意文件。
<*来源：Wolfgang Ettlinger *>测试方法： --------------------------------------------------------------------------------警 告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ Unauthenticated local file disclosure （CVE-2013-2641） As an example, an unauthenticated user can download the configuration file containing the salted hash of the administrator password as well as clear text passwords e.g. for FTP backup storage or Active Directory authentication:
Furthermore the Apache access log can be retrieved. As PHP session IDs are passed via the URL rather than via Cookies, these can be found in this log file and effectively used to impersonate administrator users:
An excerpt from the log file shows that it contains PHP session ID information （parameter "STYLE"）. <host> - - [21/Feb/2013:17:02:17 +0000] "POST /index.php？c=dashboard HTTP/1.1" 200 139 "https://www.example.com/index.php？section=configuration&c=configuration&STYLE=8514d0a3c2fc9f8d47e2988076778153" "Mozilla/5.0 （X11; Ubuntu; Linux x86_64; rv:19.0） Gecko/20100101 Firefox/19.0"建议： -------------------------------------------------------------------------------- 厂商补丁：
Sophos ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://www.sophos.cn/products/enterprise/web/security-and-control/Opera Web Browser信息泄露漏洞McAfee Email Gateway远程拒绝服务漏洞相关资讯 任意文件泄露漏洞
易网时代-编程资源站