bluecoat-bypass.txt

`Blue Coat K9 Web Protection V4.0.230 Beta Vulnerability  
Set 5, 2008  
  
-- Affected Vendors:  
Blue Coat  
  
-- Affected Products:  
K9 Web Protection V4.0.230 Beta  
  
-- Download at:  
http://www1.k9webprotection.com/getk9/beta.php  
  
-- Vulnerability Details:  
A vulnerability exists in the Blue Coat K9 Web Protection V4.0.230 Beta that  
allow anyone to bypass localy the Administration panel located at  
http://127.0.0.1:2372.  
  
To desactivate the password and get full access simply desactive javascript  
in your browser.  
  
Internet Explorer  
Untested but works  
  
Opera  
Go to TOOLS > PREFERENCES > CONTENT > unselect ENABLE JAVASCRIPT > OK  
  
The vulnerable addresses are:  
http://127.0.0.1:2372/summary  
http://127.0.0.1:2372/detail  
http://127.0.0.1:2372/overrides  
http://127.0.0.1:2372/pwemail  
  
-- Dificulty Level:  
Low  
  
-- Vendor Response:  
None  
  
-- Disclosure Timeline:  
2008-07-05 - Vulnerability reported to vendor  
2008-07-05 - Disclosed  
  
-- About:  
Fabio Pinheiro at http://dicas3000.blogspot.com  
`