Re: [Full-disclosure] Vulnerability: Web Coat K9 Web Protection 3.0.27

["jose achada" <achada.jose@xxxxxxxxx>]

Hi,

It's all explained in the url http://dicas3000.blogspot.com
(Portuguese). We have access to a javascript file that can be
modified, and do wherever we would like with the program to do.

This program is often installed in schools to block content so it's a
guaranty prank usage.  Nevertheless newer beta versions doesn't allow
this...

Fabio Pinheiro at http://dicas3000.blogspot.com


On 10/3/08, packet@xxxxxxxxxxxxxxxxxxxxxxx
<packet@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
> Heh.. this really tells everyone absolutely nothing. :)  A vulnerability 
> exists.. that let's people add a keystroke logger.. what's the vuln? :)
>
>
> On Thu, Oct 02, 2008 at 10:33:04PM +0000, jose achada wrote:
> > Blue Coat K9 Web Protection Vulnerability
> > Set 26, 2008
> >
> > -- Affected Vendors:
> > Blue Coat
> >
> > -- Affected Products:
> > K9 Web Protection
> >
> > -- Vulnerability Details:
> > This vulnerability allow a local users to modify the program to react
> > diferently. Several actions can be done such as integrating a
> > keylogger to log the administration password.
> >
> > -- Dificulty Level:
> > Low
> >
> > -- Vendor Response:
> > Received
> >
> > -- Disclosure Timeline:
> > 2008-08-26 - Vulnerability reported to vendor
> > 2008-09-02 - Vendor responded
> >
> > -- About:
> > Fabio Pinheiro
> > More info at http://dicas3000.blogspot.com
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/