CVE-2007-1685

published 2007-06-08

CVE-2007-1685: Buffer overflow in k9filter.exe in BlueCoat K9 Web Protection 3.2.36, and probably other versions before 3.2.44, allows remote attackers to cause a denial of…

Priority P3 52 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Buffer overflow in k9filter.exe in BlueCoat K9 Web Protection 3.2.36, and probably other versions before 3.2.44, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 2372.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
bluecoat	k9_web_protection	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 2372↗

filename k9filter.exe↗

url http://127.0.0.1:2372/home.html↗

command GET /home.html[Ax168][DCBA][Ax56][BBBB][AAAA]↗

• → Monitor for abnormally long HTTP GET requests directed at port 2372, which is used by k9filter.exe (BlueCoat K9 Web Protection). Oversized requests to this port are the attack vector for the buffer overflow. ↗
• → The exploit targets the SEH (Structured Exception Handler) chain. Detection of SEH-overwrite patterns (e.g., repeated 0x41/0x42 byte sequences followed by a crafted return address) in traffic to port 2372 is indicative of exploitation attempts. ↗
• → Alert on unexpected crashes or restarts of the k9filter.exe process, which may indicate a successful or attempted denial-of-service exploitation of this buffer overflow. ↗
• → The PoC targets the path /home.html on port 2372. Network signatures should flag HTTP GET requests to /home.html on port 2372 with payloads exceeding normal length (168+ bytes of padding observed in PoC). ↗

• · The vulnerability affects BlueCoat K9 Web Protection 3.2.36 and likely all versions prior to 3.2.44. Detections should account for this version range; patched versions (3.2.44+) are not reported vulnerable. ↗
• · Successful exploitation runs with administrative privileges, meaning post-exploitation activity would appear to originate from a high-privilege context — tune endpoint monitoring accordingly. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.