In-Reply-To: <200207250749.33496@Message-id-is-important> ----------------------------------------------------------- Blue Coat Systems (formerly CacheFlow) Cross Site Scripting Vulnerability ----------------------------------------------------------- Blue Coat Systems thanks T. Suzuki of Reflection Inc. / Chukyo University for the help in finding and bringing this exploit to the attention of our support team. An excellent job was done in providing a detailed explanation of the problem and the solution. To provide complete clarification Blue Coat Systems Support is providing an official response to this vulnerability. VULNERABLE SOFTWARE VERSIONS ============================ Client Accelerators CA 4.1.06 and earlier Server Accelerators SA 4.1.06 and earlier Security Gateways SG 2.1.02 and earlier EXPLOIT ======= It is possible to send HTML special characters (such as "<", ">" and "&") to the client browser via the appliance's error pages. IMPACT ====== Users may involuntarily invoke a client side script. SUGGESTED SOLUTION ================== Client Accelerators Upgrade to CA 4.1.07 or higher Server Accelerators Upgrade to SA 4.1.07 or higher Security Gateways Upgrade to SG 2.1.03 or higher ALTERNATIVE SOLUTION ==================== Client Accelerators CA 3.1.XX Upgrade the custom error pages. Download the updated error pages file and install instructions at http://download.cacheflow.com/release/CA/3.1.00-docs/v3.1-error- pages.zip CA 4.0.XX Upgrade the custom error pages. Download the updated error pages file and install instructions at http://download.cacheflow.com/release/CA/4.0.00-docs/CA4-error- pages.zip Server Accelerators SA 4.0.XX Upgrade the custom error pages. Download the updated error pages file and install instructions at http://download.cacheflow.com/release/SA/4.0.00-docs/SA4-error- pages.zip Security Gateways None Blue Coat Systems (formerly CacheFlow) Support Department UNITED STATES DOMESTIC: 866.362.2628 DOMESTIC/INTERNATIONAL CALLS: 408.220.2270 ASIA PACIFIC RIM: 81.3.5425.8492 EMAIL: support@bluecoat.com
