Blue Coat Systems K9 Web Protection Buffer Overflow May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018210
|
|
SecurityTracker URL: http://securitytracker.com/id?1018210
|
|
CVE Reference: CVE-2007-1685
(Links to External Site)
|
Date: Jun 8 2007
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 3.2.44
|
Description: A vulnerability was reported in K9 Web Protection. A remote user can cause denial of service conditions and may be able to cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted URL that, when loaded by the target user, will trigger a buffer overflow and cause the
service to crash or potentially execute arbitrary code.
A specially crafted URL for the localhost (127.0.0.1) Web configuration
manager on port 2372 can trigger the overflow.
The vendor was notified on April 4, 2007.
Dennis Rand of the CSIS Security
Group (csis.dk) discovered this vulnerability.
The original advisory is available at:
http://www.csis.dk/dk/forside/Bluecoat-k9.pdf
|
Impact: A remote user can create a URL that, when loaded by the target user, may execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a fixed version (3.2.44).
|
Vendor URL: www.k9webprotection.com/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (2000), Windows (Vista), Windows (XP)
|
Reported By: "Dennis Rand" <rand@csis.dk>
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 8 Jun 2007 09:02:48 +0200
From: "Dennis Rand" <rand@csis.dk>
Subject: CSIS Advisory: BlueCoat K9 Web Protection 3.2.36 Overflow
|
CSIS Security Group has discovered a remote exploitable arbitrary
overwrite, in the Blue Coat
K9 Web Protection local Web configuration manager on 127.0.0.1 and port
2372.
This allows an attacker to perform at least a Denial of Service
condition, on the
usage of internet.
Since the overflow can result in an overwrite of both the return address
and SHE, remote code
execution is possible.
Another attack vector could also be privilege escalation on the local
machine.
The Full advisory can be downloaded at:
http://www.csis.dk/dk/forside/Bluecoat-k9.pdf
Best regards
Dennis Rand
Malware/Security Researcher
CSIS Security Group
http://www.csis.dk
|
|
