Vulnerability CVE-2013-2503
Published: 2013-03-11   Modified: 2013-03-15

Description:
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

See advisories in our WLB2 database:
Topic
Author
Date
High
Privoxy 3.0.20-1 Proxy Authentication Credential Exposure
Chris John Riley
12.03.2013

Type:

CWE-522

 (Insufficiently Protected Credentials)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Privoxy -> Privoxy 

 References:
http://lists.opensuse.org/opensuse-updates/2013-03/msg00118.html
http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.188&view=markup
http://blog.c22.cc/2013/03/11/privoxy-proxy-authentication-credential-exposure-cve-2013-2503/
Copyright 2024, cxsecurity.com

 

Back to Top