NEOHAPSIS - Peace of Mind Through Integrity and Insight

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

Neohapsis > Archives > Bugtraq> 2002-09

From: Blue_at_mail.securityfocus.com, Coat

mail.securityfocus.com, Systems

mail.security (Blue_at_mail.securityfocus.com)
Date: Tue Sep 03 2002 - 00:37:13 CDT

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

('binary' encoding is not supported, stored as-is) In-Reply-To: <200207250749.33496Message-id-is-important>

-----------------------------------------------------------
Blue Coat Systems (formerly CacheFlow) Cross Site Scripting Vulnerability
-----------------------------------------------------------

Blue Coat Systems thanks T. Suzuki of Reflection Inc. / Chukyo University
for the help in finding and bringing this exploit to the attention of our
support team. An excellent job was done in providing a detailed
explanation of the problem and the solution. To provide complete
clarification Blue Coat Systems Support is providing an official response
to this vulnerability.

VULNERABLE SOFTWARE VERSIONS
============================

Client Accelerators
CA 4.1.06 and earlier

Server Accelerators
SA 4.1.06 and earlier

Security Gateways
SG 2.1.02 and earlier

EXPLOIT
=======

It is possible to send HTML special characters (such as "<", ">" and
"&") to the client browser via the appliance's error pages.

IMPACT
======

Users may involuntarily invoke a client side script.