ProxySG uses a "heap" to temporarily store information in memory that is currently in use by ProxySG.  A secure heap is a separate area in memory used to store sensitive information.  The information stored in the secure heap includes authentication materials for end users who are currently authenticated using HTTP basic authentication and keys that are currently in use. Authentication materials for end users who use other authentication methods (e.g., NTLM, Kerberos, X.509/certificate realm, Windows SSO, and Novell SSO) are not provided directly to ProxySG and therefore would not be cached in the secure heap.

When a core image is produced by SGOS, the data in memory that is necessary to diagnose the cause of the problem is written to the core image file. Data in the secure heap is not written to the file. In SGOS 6.1 and 6.2, the secure heap was mistakenly included in core files. 

Core files are only visible to ProxySG administrators.  An administrator can download core files from ProxySG, or may choose to send them to Blue Coat for analysis after entering a Service Request Number.  As is customary, ProxySG core files are not encrypted.

An attacker with access to a core file produced by SGOS 6.1 or 6.2 may be able to discover sensitive information that was in memory at the time the core file was produced.  Blue Coat does not publish information about how to interpret core files or provide tools to parse core files. Specialized knowledge would be needed to discover sensitive information in a core file. 

The CVSS v2 base score reflects a scenario in which a core file is downloaded from ProxySG by the administrator or sent to Blue Coat for analysis.  In this situation, an attacker needs no access to ProxySG to retrieve the core file, but does require highly specialized knowledge to obtain information from the core file that would be useful.  If the core file remains on ProxySG, the CVSS v2 base score is 1.2 (AV:L/AC:H/Au:N/C:P/I:N/A:N).

Core files are necessary in order for Blue Coat to diagnose and fix problems encountered by customers.  Blue Coat values the privacy of its customers and responsibly manages access to the core files provided to Support. 

Blue Coat recommends that customers delete core files within their own environments when they are no longer needed.