Blue Coat Systems WinProxy Remote Denial Of Service Vulnerability

Bugtraq ID:	16148
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-3187
Remote:	Yes
Local:	No
Published:	Jan 05 2006 12:00AM
Updated:	Jan 10 2006 11:31PM
Credit:	FistFuXXer is credited with the discovery of this vulnerability.
Vulnerable:	Blue Coat Systems WebProxy 6.0
Not Vulnerable:	Blue Coat Systems WebProxy 6.1 a

Blue Coat Systems WinProxy Remote Denial Of Service Vulnerability

WinProxy is prone to a remote denial of service vulnerability. This issue is due to a failure in the application to properly handle user-supplied data.

A remote attacker can exploit this issue to crash the server denying service to legitimate users.

This issue is reported to affect WinProxy version 6.0; other versions may also be vulnerable.

Blue Coat Systems WinProxy Remote Denial Of Service Vulnerability

No exploit is required.

The following proof of concept exploit code is available:

• /data/vulnerabilities/exploits/CAN-2005-3187_exploit.pl

Blue Coat Systems WinProxy Remote Denial Of Service Vulnerability

Solution:
The vendor has released an updated version addressing this issue:


Blue Coat Systems WebProxy 6.0

• Blue Coat Systems WinProxy 6.1a
  http://download.winproxy.com/downloads/WinProxy.exe

Blue Coat Systems WinProxy Remote Denial Of Service Vulnerability

References:

• WinProxy Home Page (Blue Coat Systems)
  
• WinProxy: Release Notes (Blue Coat Systems)
  
• iDefense Security Advisory 01.05.06: Blue Coat WinProxy Remote DoS Vulnerability ("[email protected]" )