full-disclosure - Blue Coat K9 Web Protection V4.0.230 Beta Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 4 Oct 2008 23:35:03 +0000
From: "Tribal MP" <tribalmp@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Blue Coat K9 Web Protection V4.0.230 Beta
	Vulnerability

Blue Coat K9 Web Protection V4.0.230 Beta Vulnerability
Set 5, 2008

-- Affected Vendors:
Blue Coat

-- Affected Products:
K9 Web Protection V4.0.230 Beta

-- Download at:
http://www1.k9webprotection.com/getk9/beta.php

-- Vulnerability Details:
A vulnerability exists in the Blue Coat K9 Web Protection V4.0.230 Beta that
allow anyone to bypass localy the Administration panel located at
http://127.0.0.1:2372.

To desactivate the password and get full access simply desactive javascript
in your browser.

Internet Explorer
Untested but works

Opera
Go to TOOLS > PREFERENCES > CONTENT > unselect ENABLE JAVASCRIPT > OK

The vulnerable addresses are:
http://127.0.0.1:2372/summary
http://127.0.0.1:2372/detail
http://127.0.0.1:2372/overrides
http://127.0.0.1:2372/pwemail

-- Dificulty Level:
Low

-- Vendor Response:
None

-- Disclosure Timeline:
2008-07-05 - Vulnerability reported to vendor
2008-07-05 - Disclosed

-- About:
Fabio Pinheiro at http://dicas3000.blogspot.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/