full-disclosure - Re: Vulnerability: Web Coat K9 Web Protection 3.0.27

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 3 Oct 2008 10:54:52 +0000
From: "jose achada" <achada.jose@...il.com>
To: "packet@...ketstormsecurity.org" <packet@...ketstormsecurity.org>
Subject: Re: Vulnerability: Web Coat K9 Web Protection
	3.0.27

Hi,

It's all explained in the url http://dicas3000.blogspot.com
(Portuguese). We have access to a javascript file that can be
modified, and do wherever we would like with the program to do.

This program is often installed in schools to block content so it's a
guaranty prank usage.  Nevertheless newer beta versions doesn't allow
this...

Fabio Pinheiro at http://dicas3000.blogspot.com


On 10/3/08, packet@...ketstormsecurity.org
<packet@...ketstormsecurity.org> wrote:
> Heh.. this really tells everyone absolutely nothing. :)  A vulnerability exists.. that let's people add a keystroke logger.. what's the vuln? :)
>
>
> On Thu, Oct 02, 2008 at 10:33:04PM +0000, jose achada wrote:
> > Blue Coat K9 Web Protection Vulnerability
> > Set 26, 2008
> >
> > -- Affected Vendors:
> > Blue Coat
> >
> > -- Affected Products:
> > K9 Web Protection
> >
> > -- Vulnerability Details:
> > This vulnerability allow a local users to modify the program to react
> > diferently. Several actions can be done such as integrating a
> > keylogger to log the administration password.
> >
> > -- Dificulty Level:
> > Low
> >
> > -- Vendor Response:
> > Received
> >
> > -- Disclosure Timeline:
> > 2008-08-26 - Vulnerability reported to vendor
> > 2008-09-02 - Vendor responded
> >
> > -- About:
> > Fabio Pinheiro
> > More info at http://dicas3000.blogspot.com
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/