CVE-2011-1499 acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origi...
LowCVSS 2.6
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| banu tinyproxy | <= 1.8.2 | No fix listed |
| banu tinyproxy | = 1.5.0 | No fix listed |
| banu tinyproxy | = 1.5.0-pre1 | No fix listed |
| banu tinyproxy | = 1.5.0-pre2 | No fix listed |
| banu tinyproxy | = 1.5.0-pre3 | No fix listed |
| banu tinyproxy | = 1.5.0-pre4 | No fix listed |
| banu tinyproxy | = 1.5.0-pre5 | No fix listed |
| banu tinyproxy | = 1.5.0-pre6 | No fix listed |
| banu tinyproxy | = 1.5.0-rc1 | No fix listed |
| banu tinyproxy | = 1.5.0-rc10 | No fix listed |
| banu tinyproxy | = 1.5.0-rc2 | No fix listed |
| banu tinyproxy | = 1.5.0-rc4 | No fix listed |
| banu tinyproxy | = 1.5.0-rc5 | No fix listed |
| banu tinyproxy | = 1.5.0-rc6 | No fix listed |
| banu tinyproxy | = 1.5.0-rc7 | No fix listed |
| banu tinyproxy | = 1.5.0-rc8 | No fix listed |
| banu tinyproxy | = 1.5.0-rc9 | No fix listed |
| banu tinyproxy | = 1.5.1 | No fix listed |
| banu tinyproxy | = 1.5.1-pre1 | No fix listed |
| banu tinyproxy | = 1.5.1-pre2 | No fix listed |
| banu tinyproxy | = 1.5.1-pre3 | No fix listed |
| banu tinyproxy | = 1.5.1-pre4 | No fix listed |
| banu tinyproxy | = 1.5.1-pre5 | No fix listed |
| banu tinyproxy | = 1.5.1-pre6 | No fix listed |
| banu tinyproxy | = 1.5.1-rc1 | No fix listed |
Show 30 more
| Product | Affected versions | Fixed in |
|---|---|---|
| banu tinyproxy | = 1.5.1-rc2 | No fix listed |
| banu tinyproxy | = 1.5.1-rc3 | No fix listed |
| banu tinyproxy | = 1.5.1-rc4 | No fix listed |
| banu tinyproxy | = 1.5.2 | No fix listed |
| banu tinyproxy | = 1.5.2-rc1 | No fix listed |
| banu tinyproxy | = 1.5.2-rc2 | No fix listed |
| banu tinyproxy | = 1.5.3 | No fix listed |
| banu tinyproxy | = 1.5.3-rc1 | No fix listed |
| banu tinyproxy | = 1.6.0 | No fix listed |
| banu tinyproxy | = 1.6.0-a | No fix listed |
| banu tinyproxy | = 1.6.0-pre1 | No fix listed |
| banu tinyproxy | = 1.6.0-pre2 | No fix listed |
| banu tinyproxy | = 1.6.0-pre3 | No fix listed |
| banu tinyproxy | = 1.6.0-pre4 | No fix listed |
| banu tinyproxy | = 1.6.0-rc1 | No fix listed |
| banu tinyproxy | = 1.6.0-rc2 | No fix listed |
| banu tinyproxy | = 1.6.0-rc3 | No fix listed |
| banu tinyproxy | = 1.6.1 | No fix listed |
| banu tinyproxy | = 1.6.2 | No fix listed |
| banu tinyproxy | = 1.6.3 | No fix listed |
| banu tinyproxy | = 1.6.4 | No fix listed |
| banu tinyproxy | = 1.6.5 | No fix listed |
| banu tinyproxy | = 1.7.0 | No fix listed |
| banu tinyproxy | = 1.7.1 | No fix listed |
| banu tinyproxy | = 1.8.0 | No fix listed |
| banu tinyproxy | = 1.8.1 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian/tinyproxy(Debian:12) | < 1.8.2-2 | 1.8.2-2 |
| debian/tinyproxy(Debian:13) | < 1.8.2-2 | 1.8.2-2 |
| debian/tinyproxy(Debian:14) | < 1.8.2-2 | 1.8.2-2 |
References
- bugs.debian.org issue-tracking patch
- [oss-security] 20110407 CVE request: tinyproxy runs as an open proxy when attempting to restrict allowable IP ranges mailing-list third-party-advisory
- [oss-security] 20110408 Re: CVE request: tinyproxy runs as an open proxy when attempting to restrict allowable IP ranges mailing-list third-party-advisory
- 44274 third-party-advisory
- DSA-2222 third-party-advisory vendor-advisory
- banu.com broken-link
- banu.com broken-link
- bugzilla.redhat.com issue-tracking patch
- tinyproxy-aclc-sec-bypass(67256) vdb-entry
- Debian Security Tracker CVE-2011-1499 vendor-advisory
- bugs.debian.org issue-tracking