Tinyproxy 'conf.c'整数溢出安全绕过漏洞

Bugtraq ID: 47715 CVE ID：CVE-2011-1499 Tinyproxy是一个小型的基于GPL的HTTP/SSL代理程序。 Tinyproxy在子网掩码生成实现上存在一个错误，当配置允许网络段时如"Allow 192.168.0.0/24"相对与默认的"Allow 127.0.0.1"，会允许任意IP地址连接，使其成为一个开放代理。如果配置使用一个或多个使用IP段的Allow语句，就会发生这种情况。 Banu Systems Private Limited Tinyproxy 1.8.2 厂商解决方案 Tinyproxy 1.8.3已经修复此漏洞，建议用户下载使用...

CVE-2011-1843

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

CVE-2011-1843

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

DEBIAN-CVE-2011-1843

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

Integer overflow

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

CVE-2011-1843

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

CVE-2011-1843

The CVE-2011-1843 issue affects Tinyproxy prior to 1.8.3, where an integer overflow in conf.c can allow remote attackers to bypass access restrictions via a TCP connection (improper handling of invalid port numbers). Public references indicate fixes exist in Tinyproxy 1.8.3 or newer; Fedora/OpenV...

CVE-2011-1843

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

CVE-2011-1843

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

CVE-2011-1843: Undefined Security Weakness

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers...

CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

Design/Logic Flaw

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

DEBIAN-CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

CVE-2011-1499

Affected software: Tinyproxy (before 1.8.3). Root cause: ACL configuration with CIDR in acl.c permits TCP connections from any IP, effectively making the proxy open. Impact: potential anonymization of traffic as the proxy can be used to hide origin. Remediation: upgrade to Tinyproxy 1.8.3 or appl...

CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

CVE-2011-1499: Undefined Security Weakness

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

Debian DSA-2222-1 : tinyproxy - incorrect ACL processing

Christoph Martin discovered that incorrect ACL processing in TinyProxy, a lightweight, non-caching, optionally anonymizing HTTP proxy, could lead to unintended network access rights. The oldstable distribution lenny is not affected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...