full-disclosure - Jetro Cockpit Secure Browsing vulnerability - remote code execution on all enterprise workstations simultaneously

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 2 Feb 2014 23:45:30 +0200
From: Ronen Z <ronen@...ji.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Jetro Cockpit Secure Browsing vulnerability -
 remote code execution on all enterprise workstations simultaneously

A critical vulnerability was discovered in Jetro Cockpit Secure Browsing, a
popular enterprise secure browsing solution.

The vulnerability allows simultaneous remote code execution into all the
enterprise workstations using the product. The vulnerability is unique in
that it breaks the basic value proposition of the security product in which
it is found.

Full disclosure and details here:
http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html

Ronen Zilberman

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/