Blue Coat ProxySG Privilege Enforcement Remote Security Bypass Vulnerability

Bugtraq ID:	42490
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2010 12:00AM
Updated:	Aug 16 2010 12:00AM
Credit:	Thierry Zoller
Vulnerable:	Blue Coat Systems ProxySG 5.5 Blue Coat Systems ProxySG 5.4 Blue Coat Systems ProxySG 5.3 Blue Coat Systems ProxySG 4.3 Blue Coat Systems ProxySG 4.2
Not Vulnerable:	Blue Coat Systems ProxySG 5.5.3.1

Blue Coat ProxySG Privilege Enforcement Remote Security Bypass Vulnerability

Blue Coat ProxySG is prone to a remote security-bypass vulnerability.

An attacker with read only administrative privileges can exploit this issue to execute arbitrary shell commands with full administrative privileges. A successful attack will result in the complete compromise of an affected appliance.

This issue affects the following versions:

Blue Coat ProxySG 5.5
Blue Coat ProxySG 5.4
Blue Coat ProxySG 5.3
Blue Coat ProxySG 4.3
Blue Coat ProxySG 4.2

Blue Coat ProxySG Privilege Enforcement Remote Security Bypass Vulnerability

Attackers can exploit this issue by using a browser.

Blue Coat ProxySG Privilege Enforcement Remote Security Bypass Vulnerability

Solution:
Updates are available; please see the references for more details.

Blue Coat ProxySG Privilege Enforcement Remote Security Bypass Vulnerability

References:

• Blue Coat ProxySG product page (Blue Coat)
  
• Blue Coat Systems Homepage (Blue Coat Systems)
  
• ProxySG privilege escalation (Blue Coat Systems)