Boris16

**Name of the Vulnerable Software and Affected Versions** 3proxy versions 0.5 through 0.5.3g 3proxy version 0.6b-devel before 20070413 **Description** A buffer overflow issue exists in the HTTP proxy service, potentially allowing remote attackers to execute arbitrary code via crafted transparent requests. **Recommendations** For 3proxy versions 0.5 through 0.5.3g, update to a version later than 0.5.3g. For 3proxy version 0.6b-devel before 20070413, update to a version from 20070413 or later.

**Name of the Vulnerable Software and Affected Versions** 3proxy versions 0.5 through 0.5.2 **Description** The issue allows remote attackers to cause a denial of service, specifically a blocked account, when NT-encoded passwords are used. This is related to NTLM authentication and results in a password hash being overwritten. **Recommendations** For versions 0.5 through 0.5.2, consider disabling NTLM authentication until a patch is available to prevent the denial of service. Restrict access to accounts using NT-encoded passwords to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** 3proxy versions 0.5 through 0.5.2 **Description** The issue arises because 3proxy does not prioritize NTLM authentication over basic authentication, which can lead to browsers using basic cleartext authentication even when NTLM is available. This makes it easier for attackers to steal credentials, particularly affecting browsers with incomplete support for RFC2616 and RFC2617. **Recommendations** For versions 0.5 through 0.5.2, consider configuring the server to prioritize NTLM authentication, if possible, to mitigate the risk of credential theft. However, the exact configuration steps are not provided, so it is essential to consult the official documentation for guidance on authentication settings. At the moment, there is no information about a newer version that contains a fix for this vulnerability.