National Cyber-Alert System

Vulnerability Summary for CVE-2007-2952

Overview

Multiple stack-based buffer overflows in the filter service (aka k9filter.exe) in Blue Coat K9 Web Protection 3.2.44 with Filter 3.2.32 allow (1) remote attackers to execute arbitrary code via a long HTTP Referer header to the K9 Web Protection Administration interface and (2) man-in-the-middle attackers to execute arbitrary code via an HTTP response with a long HTTP version field.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: bluecoat-k9-version-bo(44124)

Hyperlink:http://xforce.iss.net/xforce/xfdb/44124

External Source: XF

Name: bluecoat-k9-referer-bo(44123)

Hyperlink:http://xforce.iss.net/xforce/xfdb/44123

External Source: SECTRACK

Name: 1020588

Hyperlink:http://www.securitytracker.com/id?1020588

External Source: SECTRACK

Name: 1020587

Hyperlink:http://www.securitytracker.com/id?1020587

External Source: BID

Name: 30464

Hyperlink:http://www.securityfocus.com/bid/30464

External Source: BID

Name: 30463

Hyperlink:http://www.securityfocus.com/bid/30463

External Source: BUGTRAQ

Name: 20080731 Secunia Research: Blue Coat K9 Web Protection Response Handling Buffer Overflows

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/494984/100/0/threaded

External Source: BUGTRAQ

Name: 20080731 Secunia Research: Blue Coat K9 Web Protection "Referer" Header Buffer Overflow

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/494975/100/0/threaded

External Source: VUPEN

Name: ADV-2008-2263

Hyperlink:http://www.frsirt.com/english/advisories/2008/2263/references

External Source: MISC

Name: http://secunia.com/secunia_research/2007-64/advisory/

Type: Advisory

Hyperlink:http://secunia.com/secunia_research/2007-64/advisory/

External Source: MISC

Name: http://secunia.com/secunia_research/2007-61/advisory/

Type: Advisory

Hyperlink:http://secunia.com/secunia_research/2007-61/advisory/

External Source: SECUNIA

Name: 25813

Type: Advisory

Hyperlink:http://secunia.com/advisories/25813