Sophos fixes vulns in its Web security appliance

Security firm Sophos has asked that its customers install version 3.7.8.2 of the Web Protection Appliance immediately. At the end of February, staff at security firm SEC Consult discovered vulnerabilities in the product’s web-based user interface. Sophos has closed the security holes in the latest version. The vulnerabilities allow attackers to harvest sensitive data such as passwords and session cookies and provide access to private certificate keys.<more>