PT-2004-3290 · Blue Coat · Blue Coat Security Gateway Os

Published 2004-12-31 · Updated 2024-02-13 · CVE-2004-2397

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Blue Coat Security Gateway OS versions 3.0 through 3.1.3.13 Blue Coat Security Gateway OS version 3.2.1

Description: The web-based Management Console in the affected software stores a private key and its passphrase in plaintext in a log file when importing the key. This allows attackers to steal digital certificates.

Recommendations: For Blue Coat Security Gateway OS versions 3.0 through 3.1.3.13, consider restricting access to the log files to minimize the risk of exploitation. For Blue Coat Security Gateway OS version 3.2.1, consider restricting access to the log files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2004-2397

Affected Products

Blue Coat Security Gateway Os

References · 7

• http://securityfocus.com/bid/10371 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2397 · Security Note
• http://bluecoat.com/support/knowledge/advisory_private_key_compromise.html · Vendor Advisory
• http://secunia.com/advisories/11627 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16182 · Note
• https://t.me/cvenotify/71243 · Telegram Post
• http://osvdb.org/6218 · Note