PT-2009-3403 · Ziproxy · Ziproxy

Robert Auger · Published 2009-03-04 · Updated 2009-06-18 · CVE-2009-0804

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ziproxy version 2.6.0

Description The issue allows remote attackers to bypass access controls for certain technologies, such as Flash, Java, and Silverlight, and possibly communicate with restricted intranet sites. This is achieved through a crafted web page that causes a client to send HTTP requests with a modified Host header when transparent interception mode is enabled.

Recommendations For Ziproxy version 2.6.0, consider disabling transparent interception mode until a patch is available to prevent the modification of the Host header and mitigate the risk of access control bypass.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-0804

Affected Products

Ziproxy

References · 7

• https://osv.dev/vulnerability/CVE-2009-0804 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0804 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0804 · Vendor Advisory
• http://kb.cert.org/vuls/id/MAPG-7N9GN8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0804 · Security Note
• http://kb.cert.org/vuls/id/435052 · Note
• http://securityfocus.com/bid/33858 · Note