PT-2013-3826 · Privoxy+1 · Privoxy+1

Chris John Riley · Published 2013-03-11 · Updated 2015-03-27 · CVE-2013-2503

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Privoxy versions prior to 3.0.21

Description The issue makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 HTTP status code by not properly handling Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream.

Recommendations For versions prior to 3.0.21, update to version 3.0.21 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1330

CVE-2013-2503

Affected Products

Alt Linux

Privoxy

References · 14

• 🔥 https://exploit-db.com/exploits/38377 · Exploit
• 🔥 http://blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503 · Exploit
• http://lists.opensuse.org/opensuse-updates/2013-03/msg00118.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2503 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2503 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2503 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-2503 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2503 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1330 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-2503 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-2503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2503 · Security Note
• https://packages.altlinux.org/ru/vuln/CVE-2013-2503 · Note
• http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.188&view=markup · Note