Astaro Security Linux HTTP CONNECT Unauthorized Access Weakness

Bugtraq ID:	14665
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 25 2005 12:00AM
Updated:	Aug 25 2005 12:00AM
Credit:	Discovery credited to Oliver Karow <[email protected]>.
Vulnerable:	Astaro Security Linux 6.0 01
Not Vulnerable:	Astaro Security Linux 6.0 02

Astaro Security Linux HTTP CONNECT Unauthorized Access Weakness

Astaro Security Linux is prone to a weakness that may allow remote attackers to connect to arbitrary ports on a vulnerable computer.

This weakness may be combined with other attacks to exploit latent vulnerabilities. An attacker can bypass access controls implemented by the application through this attack.

Astaro Security Linux 6.001 is prone to this weakness.

Astaro Security Linux HTTP CONNECT Unauthorized Access Weakness

An exploit is not required.

Connect to TCP port 8080 and enter the following command:

CONNECT localhost:80 HTTP/1.0

Astaro Security Linux HTTP CONNECT Unauthorized Access Weakness

Solution:
The vendor has addressed this issue in Astaro Security Linux version 6.002:


Astaro Security Linux 6.0 01

• Astaro Astaro 6.002
  http://download.astaro.com/Astaro_Security_Linux/v6.0/up2date/

Astaro Security Linux HTTP CONNECT Unauthorized Access Weakness

References:

• Astaro Security Gateway Homepage (Astaro)
  
• Up2Date 6.002 (Astaro)
  
• Astaro Security Linux 6.0 - HTTP CONNECT Access Localhost Weakness (oliver karow )