Check Point Advisories

Preemptive Protection against BlueCoat WinProxy Host Header Stack Overflow Vulnerability

Check Point Reference:	CPAI-2006-034
Date Published:	5 Apr 2006
Severity:	Medium
Last Updated:	Monday 07 May, 2007
Source:	iDEFENSE ID: 01.05.06
Industry Reference:	CVE-2005-4085
Protection Provided by:
Who is Vulnerable?	WinProxy 4 WinProxy 5.x WinProxy 6.x
Vulnerability Description	BlueCoat WinProxy is an Internet sharing proxy server designed for small to medium businesses. A vulnerability that was detected in WinProxy could allow remote execution of arbitrary code. The vulnerability can be triggered by sending an overly long Host string in a HTTP request to the Web proxy service. SmartDefense preemptively protects against this vulnerability by blocking binary and non ASCII characters in HTTP requests and form fields.
Update/Patch Avaliable	Update to version 6.1a: http://www.winproxy.com/
Vulnerability Details	The vulnerability can be triggered when a long host header string is sent to the device. This will overwrite the SEH handler for the frame allowing for control over EIP.