363425 – (CVE-2011-1499) <net-proxy/tinyproxy-1.8.3 : Multiple Vulnerabilities (CVE-2011-{1499,1843})

Bug 363425 (CVE-2011-1499) - <net-proxy/tinyproxy-1.8.3 : Multiple Vulnerabilities (CVE-2011-{1499,1843})

Summary: <net-proxy/tinyproxy-1.8.3 : Multiple Vulnerabilities (CVE-2011-{1499,1843})

Status:	RESOLVED FIXED

Alias:	CVE-2011-1499

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://banu.com/bugzilla/show_bug.cg...
Whiteboard:	C4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2011-04-13 04:50 UTC by Tim Sammut (RETIRED)
Modified:	2011-08-28 02:12 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Tim Sammut (RETIRED) gentoo-dev

2011-04-13 04:50:57 UTC

When tinyproxy is configured with ACLs using network/mask notation it incorrectly operates as an open proxy. 

Upstream bug is at $URL, fix/commit at https://banu.com/cgit/tinyproxy/commit/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4, and I don't believe upstream has released a fixed version of the package yet.

Comment 1 Tim Sammut (RETIRED) gentoo-dev

2011-05-10 03:53:29 UTC

The NVD also lists CVE-2011-1843 as fixed in tinyproxy 1.8.3 which I don't see available yet.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1843

Comment 2 Jeroen Roovers (RETIRED) gentoo-dev

2011-06-10 03:33:49 UTC

https://banu.com/bugzilla/buglist.cgi?product=tinyproxy&target_milestone=1.8.3
 --> https://banu.com/bugzilla/show_bug.cgi?id=90

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2011-06-13 18:15:35 UTC

CVE-2011-1843 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1843):
  Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote
  attackers to bypass intended access restrictions in opportunistic
  circumstances via a TCP connection, related to improper handling of invalid
  port numbers.

CVE-2011-1499 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1499):
  acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting
  specifies a CIDR block, permits TCP connections from all IP addresses, which
  makes it easier for remote attackers to hide the origin of web traffic by
  leveraging the open HTTP proxy server.

Comment 4 Jeroen Roovers (RETIRED) gentoo-dev

2011-08-16 22:42:53 UTC

Arch teams, please test and mark stable:
=net-proxy/tinyproxy-1.8.3
Target KEYWORDS="alpha amd64 ia64 ppc sparc x86"

Comment 5 Paweł Hajdan, Jr. (RETIRED) gentoo-dev

2011-08-17 03:46:54 UTC

x86 stable

Comment 6 Elijah "Armageddon" El Lazkani (amd64 AT) 2011-08-17 04:49:04 UTC

amd64: emerges fine

Comment 7 Agostino Sarubbo gentoo-dev

2011-08-17 12:29:18 UTC

amd64 ok

Comment 8 Tony Vroon (RETIRED) gentoo-dev

2011-08-17 13:02:45 UTC

+  17 Aug 2011; Tony Vroon <chainsaw@gentoo.org> tinyproxy-1.8.3.ebuild:
+  1.8.3 marked stable on AMD64 based on arch testing by Elijah El Lazkani &
+  Agostino "ago" Sarubbo in security bug #363425 filed by Tim Sammut.

Comment 9 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev

2011-08-18 07:31:52 UTC

ppc stable

Comment 10 Raúl Porcel (RETIRED) gentoo-dev

2011-08-27 17:39:04 UTC

alpha/ia64/sparc stable

Comment 11 Tim Sammut (RETIRED) gentoo-dev

2011-08-28 02:12:09 UTC

Thanks, everyone. Closing noglsa.