CVE-2018-5527

On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel tmm to leak memory. As a result, system memory usage...

CVE-2018-5527

On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel tmm to leak memory. As a result, system memory usage...

Debian DSA-4128-1 : trafficserver - security update

Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server. They could lead to the use of an incorrect upstream proxy, or allow a remote attacker to cause a denial-of-service by application crash. C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 4128-1] trafficserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4128-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 02, 2018 https://www.debian.org/security/faq -...

CVE-2017-6147

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles...

Design/Logic Flaw

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles...

CVE-2017-6147

CVE-2017-6147 affects F5 BIG-IP products (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe, and others) where enabling SSL Forward Proxy on both Client and Server SSL profiles can cause TMM to restart and interrupt traffic. The F5 advisory K43945001 lists multiple vulnerable...

CVE-2017-6147

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles...

F5 Networks BIG-IP : F5 TMM vulnerability (K43945001)

An undisclosed type of responses may cause TMM to restart, causing an interruption of service when 'SSL Forward Proxy' setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server. CVE-2017-6147 Impact If the SSL Forward Proxy option is enabled on both the...

httpd: mod_cache NULL pointer dereference crash

A NULL pointer dereference flaw was found in the modcache httpd module. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP Server was used as a forward proxy with caching...

httpd: mod_cache NULL pointer dereference crash

A NULL pointer dereference flaw was found in the modcache httpd module. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP Server was used as a forward proxy with caching...

DEBIAN-CVE-2013-4352

The cacheinvalidate function in modules/cache/cachestorage.c in the modcache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service NULL pointer dereference and daemon crash via vectors that trigger a missing hostna...

UBUNTU-CVE-2013-4352

The cacheinvalidate function in modules/cache/cachestorage.c in the modcache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service NULL pointer dereference and daemon crash via vectors that trigger a missing hostna...

Scientific Linux Security Update : httpd on SL5.x

Problem description : A flaw was found in the Apache HTTP Server modproxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is...

Scientific Linux Security Update : httpd on SL4.x i386/x86_64

A flaw was found in the Apache HTTP Server modproxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker...

nginx Proxy DNS Cache Domain Spoofing Vulnerability

The 'nginx' program is prone to a vulnerability that may allow attackers to spoof domains because the software fails to properly compare domains when referencing an internal DNS cache. This issue can be exploited when nginx is configured to act as a forward proxy, but this is a nonstandard and...

nginx internal DNS cache poisoning

nginx maintains an internal DNS cache for resolved domain names. However, when searching the cache, nginx only checks that the crc32 of the names match and that the shorter name is a prefix of the longer name. It does not check that the names are equal in length. One way to exploit this is if ngi...

Fedora 8 : httpd-2.2.9-1.fc8 (2008-6314)

This update includes the latest release of httpd 2.2. A security issue is fixed in this update: A flaw was found in the handling of excessive interim responses from an origin server when using modproxyhttp. In a forward proxy configuration, if a user of the proxy could be tricked into visiting a...

Fedora 9 : httpd-2.2.9-1.fc9 (2008-6393)

This update includes the latest release of httpd 2.2. Two security issues are fixed in this update: A flaw was found in the handling of excessive interim responses from an origin server when using modproxyhttp. In a forward proxy configuration, if a user of the proxy could be tricked into visitin...

DEBIAN-CVE-2007-3847

The date handling code in modules/proxy/proxyutil.c modproxy in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service caching forward proxy process crash via crafted date headers that trigger a buffer over-read...