Blue Coat Systems Error Page Cross Site Scripting Vulnerability
BID:5608
Info
Blue Coat Systems Error Page Cross Site Scripting Vulnerability
| Bugtraq ID: | 5608 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Sep 03 2002 12:00AM |
| Credit: | Vulnerability announced in a Blue Coat Systems advisory. |
| Vulnerable: |
CacheFlow Server Accelerator 4.1 .06 CacheFlow Security Gateway 2.1 .02 CacheFlow Client Accelerator 4.1 .06 |
| Not Vulnerable: |
CacheFlow Server Accelerator 4.1 .07 CacheFlow Security Gateway 2.1 .03 CacheFlow Client Accelerator 4.1 .07 |
Discussion
Blue Coat Systems Error Page Cross Site Scripting Vulnerability
Blue Coat Systems are the maintainers of the former Cacheflow web cache and security products.
It has been discovered that the error pages of older Cacheflow systems firmware may allow the display of certain characters used in HTML tags. By visiting a custom-crafted URI supplied by an attacker, inclusion of these special characters could result in the execution of arbitrary script code by a visiting client. Any code executed on the client would be in the security context of the local user, and the security zone of the Cacheflow device.
Blue Coat Systems are the maintainers of the former Cacheflow web cache and security products.
It has been discovered that the error pages of older Cacheflow systems firmware may allow the display of certain characters used in HTML tags. By visiting a custom-crafted URI supplied by an attacker, inclusion of these special characters could result in the execution of arbitrary script code by a visiting client. Any code executed on the client would be in the security context of the local user, and the security zone of the Cacheflow device.
Exploit / POC
Blue Coat Systems Error Page Cross Site Scripting Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Blue Coat Systems Error Page Cross Site Scripting Vulnerability
Solution:
For users that are capable of upgrading vulnerable systems, the vendor has made fixed versions of firmware available. The vendor advises upgrading to the fixed versions specified in the referenced vendor advisory.
CacheFlow Client Accelerator 4.1 .06
CacheFlow Server Accelerator 4.1 .06
Solution:
For users that are capable of upgrading vulnerable systems, the vendor has made fixed versions of firmware available. The vendor advises upgrading to the fixed versions specified in the referenced vendor advisory.
CacheFlow Client Accelerator 4.1 .06
-
Blue Coat Systems CA4-error-pages.zip
Client Accelerator Versions 4.0.xx
http://download.cacheflow.com/release/CA/4.0.00-docs/CA4-error-pages.z ip -
Blue Coat Systems v3.1-error-pages.zip
Client Accelerator Versions 3.1.xx
http://download.cacheflow.com/release/CA/3.1.00-docs/v3.1-error-pages. zip
CacheFlow Server Accelerator 4.1 .06
-
Blue Coat Systems SA4-error-pages.zip
Server Accelerator Versions 4.0.xx
http://download.cacheflow.com/release/SA/4.0.00-docs/SA4-error-pages.z ip
References
Blue Coat Systems Error Page Cross Site Scripting Vulnerability
References:
References:
- Blue Coat Systems Homepage (Blue Coat Systems)