Ubuntu.comUB:CVE-2009-0801CVE-2009-0801
5.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:H/Au:N/C:C/I:N/A:N
0.002 Low
EPSS
Percentile
51.9%
Squid, when transparent interception mode is enabled, uses the HTTP Host
header to determine the remote endpoint, which allows remote attackers to
bypass access controls for Flash, Java, Silverlight, and probably other
technologies, and possibly communicate with restricted intranet sites, via
a crafted web page that causes a client to send HTTP requests with a
modified Host header.
Bugs
- <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0801>
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521052>
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521053>
- <http://bugs.squid-cache.org/show_bug.cgi?id=3243>
Notes
| Author | Note |
|---|---|
| sbeattie | according to squid bug report, fixed in squid 3.2, which hasn’t us yet; bug report notes to not backport fix |
| mdeslaur | upstream doesn’t consider the issue important enough to create a fix for <3.2. We aren’t going to fix either. |
Related
5.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:H/Au:N/C:C/I:N/A:N
0.002 Low
EPSS
Percentile
51.9%