PT-2009-3403 · Ziproxy · Ziproxy

Robert Auger · Publicado 2009-03-04 · Atualizado 2009-06-18 · CVE-2009-0804

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Média

Vetor base

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ziproxy version 2.6.0

Description The issue allows remote attackers to bypass access controls for certain technologies, such as Flash, Java, and Silverlight, and possibly communicate with restricted intranet sites. This is achieved through a crafted web page that causes a client to send HTTP requests with a modified Host header when transparent interception mode is enabled.

Recommendations For Ziproxy version 2.6.0, consider disabling transparent interception mode until a patch is available to prevent the modification of the Host header and mitigate the risk of access control bypass.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0804

Produtos afetados

Ziproxy

Referências · 7

• http://kb.cert.org/vuls/id/435052 · Nota
• https://osv.dev/vulnerability/CVE-2009-0804 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-0804 · Aviso do Fabricante
• http://securityfocus.com/bid/33858 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0804 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/MAPG-7N9GN8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0804 · Nota de Segurança