acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.
References
| Link | Resource |
|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621493 | Issue Tracking Patch |
| http://openwall.com/lists/oss-security/2011/04/07/9 | Mailing List Third Party Advisory |
| http://openwall.com/lists/oss-security/2011/04/08/3 | Mailing List Third Party Advisory |
| http://secunia.com/advisories/44274 | |
| http://www.debian.org/security/2011/dsa-2222 | Third Party Advisory |
| https://banu.com/bugzilla/show_bug.cgi?id=90 | Broken Link |
| https://banu.com/cgit/tinyproxy/diff/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4 | Broken Link |
| https://bugzilla.redhat.com/show_bug.cgi?id=694658 | Issue Tracking Patch |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/67256 |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
No history.
Information
Published : 2011-04-29 22:55
Updated : 2023-12-10 11:03
NVD link : CVE-2011-1499
Mitre link : CVE-2011-1499
CVE.ORG link : CVE-2011-1499
JSON object : View
Products Affected
debian
- debian_linux
banu
- tinyproxy
CWE
CWE-16
Configuration