Multiple Vendor HTTP CONNECT TCP Tunnel Vulnerability
BID:4131
Info
Multiple Vendor HTTP CONNECT TCP Tunnel Vulnerability
| Bugtraq ID: | 4131 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 19 2002 12:00AM |
| Updated: | Feb 19 2002 12:00AM |
| Credit: | Published by Volker Tanger <[email protected]>. Additional vulnerable packages contributed by Ronald F. Guilmette <[email protected]>. |
| Vulnerable: |
W3C httpd 3.0 Unitech Networks Netplicator Trend Micro InterScan WebManager 1.2 Trend Micro InterScan WebManager 1.2 Trend Micro Interscan Viruswall (Linux) 3.6 tinyproxy tinyproxy 1.4.3 tinyproxy tinyproxy 1.3.3 tinyproxy tinyproxy 1.3.2 Symantec I-Gear MS Proxy 3.5 SonicWALL TELE3 SonicWALL SOHO 5.1.5 .0 SonicWALL SOHO 5.0 .0 SonicWALL SOHO 4.0 .0 SonicWALL PRO300 SonicWALL PRO200 SonicWALL PRO100 SonicWALL GX 6500 SonicWALL GX 2500 Sambar Server 5.1 Sambar Server 5.0 beta6 Sambar Server 5.0 beta5 Sambar Server 5.0 beta4 Sambar Server 5.0 beta3 Sambar Server 5.0 beta2 Sambar Server 5.0 beta1 Sambar Server 4.4 Beta 3 Sambar Server 4.4 production Sambar Server 4.3 beta 9 Sambar Server 4.3 production Sambar Server 4.3 Sambar Server 4.2.1 production Sambar Server 4.2 beta 8 Sambar Server 4.2 beta 7 Sambar Server 4.1 beta Sambar Server 4.1 production proNETIX Ltd. TopProxy Pi-Soft SpoonProxy 2.6 .6 Pi-Soft SpoonProxy 2.6 .5 Pi-Soft SpoonProxy 2.6 .14 Pi-Soft SpoonProxy 2.6 .13 Pi-Soft SpoonProxy 2.6 Pi-Soft SpoonProxy 2.5 Pi-Soft SpoonProxy 2.4.50 Pi-Soft SpoonProxy 2.3 Pi-Soft SpoonProxy 2.2 Pi-Soft SpoonProxy 2.1.1 Pi-Soft SpoonProxy 2.1 Pi-Soft SpoonProxy 2.0 Pi-Soft SpoonProxy 1.61 Pi-Soft SpoonProxy 1.60 Omnicron OmniHTTPD 2.4 Pro Omnicron OmniHTTPD 2.0.8 Omnicron OmniHTTPD 2.0.7 Omnicron OmniHTTPD 2.0.6 Omnicron OmniHTTPD 2.0.5 Omnicron OmniHTTPD 2.0.4 Omnicron OmniHTTPD 2.0 Alpha 2 Omnicron OmniHTTPD 2.0 Alpha 1 Omnicron OmniHTTPD 1.1 Novell BorderManager Enterprise Edition 3.5 Novell BorderManager 3.6 Novell BorderManager 3.5 Novell BorderManager 3.4 Novell BorderManager 3.3 Novell BorderManager 3.2 Novell BorderManager 3.1 Novell BorderManager 3.0 Network Associates WebShield for Solaris 4.1 Network Associates WebShield for Solaris 4.0 Network Associates WebShield e500 Network Associates WebShield e250 Network Associates Gauntlet Firewall 5.5 Network Associates Gauntlet Firewall 5.0 Netscape FastTrack Server 4.0.1 Netscape FastTrack Server 3.0.1 B Netscape FastTrack Server 3.0.1 Netscape FastTrack Server 2.0.1 C Netscape FastTrack Server 2.0.1 a Netscape FastTrack Server 2.0.1 NetcPlus BrowseGate 2.80.2 NetcPlus BrowseGate 2.80 NetApp NetCacheC700 Series NetApp NetCacheC6100 Series NetApp NetCacheC3100 Series NetApp NetCacheC1100 Series NEC Express5800/SURFNAVI NCSA httpd 1.5.2 a NCSA httpd 1.5.2 NCSA httpd 1.5.1 NCSA httpd 1.5 a-export NCSA httpd 1.4.2 NCSA httpd 1.4.1 NCSA httpd 1.4 NCSA httpd 1.3 NCSA httpd 1.2 NCSA httpd 1.1 NCSA httpd 1.0 MyWebServer MyWebServer 1.0.1 Microsoft IIS 5.1 Microsoft IIS 5.0 Microsoft IIS 4.0 alpha Microsoft IIS 4.0 Microsoft IIS 3.0 Microsoft IIS 2.0 Microsoft IIS 1.0 Medusa Medusa 20010416 Lotus Domino Server 5.0 Lotus Domino Server 4.6.6 Lotus Domino Server 4.6 .x Lotus Domino Server 4.6 Lotus Domino Enterprise Server 5.0.4 Lotus Domino Enterprise Server 5.0.3 Lotus Domino Enterprise Server 5.0.2 b Lotus Domino Enterprise Server 5.0.2 Lotus Domino Enterprise Server 5.0.1 Lotus Domino 5.0.9 a Lotus Domino 5.0.9 Lotus Domino 5.0.8 -french Lotus Domino 5.0.8 Lotus Domino 5.0.7 a Lotus Domino 5.0.7 Lotus Domino 5.0.6 Lotus Domino 5.0.5 -french Lotus Domino 5.0.5 Lotus Domino 5.0.4 Lotus Domino 5.0.3 Lotus Domino 5.0.2 Lotus Domino 5.0.1 Lotus Domino 5.0 Lotus Domino 4.6.4 Lotus Domino 4.6.3 Lotus Domino 4.6.1 LiteServe LiteServe 1.36 LiteServe LiteServe 1.31 LiteServe LiteServe 1.4 LiteServe LiteServe 1.3 Korea Network Intelligence CatchWeb 2000-e plus Korea Network Intelligence CatchWeb 2000-e Jana Server Jana Server 2.0 Ipswitch WS_FTP Server 1.0.2 EVAL Ipswitch WS_FTP Server 1.0.1 EVAL Ipswitch WS FTP Server 2.0.4 Ipswitch WS FTP Server 2.0.3 Ipswitch WS FTP Server 2.0.2 Ipswitch WS FTP Server 2.0.1 Ipswitch WS FTP Server 2.0 Ipswitch WS FTP Server 1.0.5 Ipswitch WS FTP Server 1.0.4 Ipswitch WS FTP Server 1.0.3 Ipswitch WS FTP Server 1.0.2 Ipswitch WS FTP Server 1.0.1 Ipswitch IMail 7.0.4 Ipswitch IMail 7.0.3 Ipswitch IMail 7.0.2 Ipswitch IMail 7.0.1 Ipswitch IMail 6.4 Ipswitch IMail 6.3 Ipswitch IMail 6.2 Ipswitch IMail 6.1 Ipswitch IMail 6.0.6 Ipswitch IMail 6.0.5 Ipswitch IMail 6.0.4 Ipswitch IMail 6.0.3 Ipswitch IMail 6.0.2 Ipswitch IMail 6.0.1 Ipswitch IMail 6.0 Ipswitch IMail 5.0.8 Ipswitch IMail 5.0.7 Ipswitch IMail 5.0.6 Ipswitch IMail 5.0.5 Ipswitch IMail 5.0 Internet Factory Proxy Builder InterGate Proxy/Cache Server 2.9 Inmon Traffic Server 2.1.6 Inmon Traffic Server 2.0 .21 Inmon Traffic Server 2.0 .16 Inmon Traffic Server 2.0 .15 Imatix Xitami for Windows 2.5 b5 Imatix Xitami for Windows 2.5 b4 Imatix Xitami for Windows 2.4 d9 Imatix Xitami for Windows 2.4 d7 Imatix Xitami for Windows 2.4 d2 Imatix Xitami 2.5 b5 Imatix Xitami 2.5 Imatix Xitami 2.4 d9 Imatix Xitami 2.4 b1 Imatix Xitami 2.4 b Imatix Xitami 2.4 a1 Imatix Xitami 2.4 IBM HTTP Server 1.3.19 IBM HTTP Server 1.3.12 .4 IBM HTTP Server 1.3.12 .3 IBM HTTP Server 1.3.12 .2 IBM HTTP Server 1.3.6 win32 IBM HTTP Server 1.3.6 .4 win32 IBM HTTP Server 1.3.6 .3 IBM HTTP Server 1.3.6 .2 win32 IBM HTTP Server 1.3.6 .2 unix IBM HTTP Server 1.3.3 win32 httptunnel client httptunnel client win32 Grok Developments NetProxy 4.1 Grok Developments NetProxy 4.0 Finjan Software SurfinGate 6.0 1 Finjan Software SurfinGate 4.0 FileMaker FileMaker Pro 5.5 FileMaker FileMaker Pro 5.0 Etype Eserv 2.98 Etype Eserv 2.97 Etype Eserv 2.96 Etype Eserv 2.95 BETA2 Etype Eserv 2.95 Etype Eserv 2.94 Etype Eserv 2.93 Etype Eserv 2.92 Etype Eserv 2.50 Etype Eserv 2.9.2 DeleGate DeleGate 7.8.2 DeleGate DeleGate 7.8.1 DeleGate DeleGate 7.8 .0 DeleGate DeleGate 7.7.1 DeleGate DeleGate 7.7 .0 Deerfield.com WinGate 4.5 Deerfield.com WebSite 3.1.11 .0 CSM Proxy 5.0 CSM Proxy 4.2 CSM Proxy 4.1 CompuSource (Pty) Ltd Power Web Server++ 4.1 Check Point Software Firewall-1 4.1 SP5 Check Point Software Firewall-1 4.1 SP4 Check Point Software Firewall-1 4.1 SP3 Check Point Software Firewall-1 4.1 SP2 Check Point Software Firewall-1 4.1 SP1 Check Point Software Firewall-1 4.1 Check Point Software Firewall-1 4.0 SP8 Check Point Software Firewall-1 4.0 SP7 Check Point Software Firewall-1 4.0 SP6 Check Point Software Firewall-1 4.0 SP5 Check Point Software Firewall-1 4.0 SP4 Check Point Software Firewall-1 4.0 SP3 Check Point Software Firewall-1 4.0 SP2 Check Point Software Firewall-1 4.0 SP1 Check Point Software Firewall-1 4.0 CacheFlow CacheOS 4.0.14 CacheFlow CacheOS 4.0.13 CacheFlow CacheOS 4.0.12 CacheFlow CacheOS 4.0.11 CacheFlow CacheOS 4.0 CacheFlow CacheOS 3.1.21 CacheFlow CacheOS 3.1.19 CacheFlow CacheOS 3.1.18 CacheFlow CacheOS 3.1.17 CacheFlow CacheOS 3.1.16 CacheFlow CacheOS 3.1.15 CacheFlow CacheOS 3.1.14 CacheFlow CacheOS 3.1.13 CacheFlow CacheOS 3.1.12 CacheFlow CacheOS 3.1.11 CacheFlow CacheOS 3.1 .20 CacheFlow CacheOS 3.1 .10 CacheFlow CacheOS 3.1 .09 CacheFlow CacheOS 3.1 .08 CacheFlow CacheOS 3.1 .07 CacheFlow CacheOS 3.1 .06 CacheFlow CacheOS 3.1 .05 CacheFlow CacheOS 3.1 .04 CacheFlow CacheOS 3.1 .03 CacheFlow CacheOS 3.1 .02 CacheFlow CacheOS 3.1 CacheFlow CacheOS Boramae Boramae Cache Server 3.5.1 Avirt Gateway Suite 4.2 Avirt Gateway Suite 3.5 Avirt Gateway Suite 3.3 a Avirt Gateway Suite 3.3 Avirt Gateway 4.2 Astaro Security Linux 3.2 12 Astaro Security Linux 3.2 11 Astaro Security Linux 3.2 10 Astaro Security Linux 3.2 00 AscenVision AscenCache Model 7060 AscenVision AscenCache Model 5030 AscenVision AscenCache Model 3020 AscenVision AscenCache Model 1010 ArGoSoft Mail Server 1.8 .0.3 ArGoSoft Mail Server 1.8 .0.1 ArGoSoft Mail Server 1.8 .0.0 ArGoSoft Mail Server 1.7 .0.4 ArGoSoft Mail Server 1.7 .0.3 ArGoSoft Mail Server 1.7 .0.2 ArGoSoft Mail Server 1.7 .0.1 ArGoSoft Mail Server 1.7 .0.0 Apache Tomcat 4.0.2 Apache Tomcat 4.0.1 Apache Tomcat 4.0 Apache Tomcat 3.3 Apache Tomcat 3.2.1 Apache Tomcat 3.2 Apache Tomcat 3.1 Apache Tomcat 3.0 AnalogX SimpleServer:WWW 1.16 AnalogX SimpleServer:WWW 1.15 AnalogX SimpleServer:WWW 1.13 AnalogX SimpleServer:WWW 1.8 AnalogX SimpleServer:WWW 1.0.8 AnalogX SimpleServer:WWW 1.0.7 AnalogX SimpleServer:WWW 1.0.6 AnalogX SimpleServer:WWW 1.0.5 AnalogX SimpleServer:WWW 1.0.4 AnalogX SimpleServer:WWW 1.0.3 AnalogX SimpleServer:WWW 1.0.1 AllegroSurf AllegroSurf 4.3 AllegroSurf AllegroSurf 4.2 .0.2 AllegroSurf AllegroSurf 4.2 .0.1 AllegroSurf AllegroSurf 4.2 .0.0 AllegroSurf AllegroSurf 4.1 .0.2 AllegroSurf AllegroSurf 4.1 .0.1 AllegroSurf AllegroSurf 4.0 .0.1 AllegroSurf AllegroSurf 4.0 AllegroSurf AllegroSurf 3.0 .1.3 AllegroSurf AllegroSurf 3.0 .1.2 AllegroSurf AllegroSurf 3.0 .1.0 AllegroSurf AllegroSurf 3.0 AdTran Express 6120 IDSL Remote Access Router Acme thttpd 2.22 Acme thttpd 2.21 Acme thttpd 2.20 Acme thttpd 2.19 Acme thttpd 2.18 Acme thttpd 2.17 Acme thttpd 2.16 Acme thttpd 2.15 Acme thttpd 2.14 Acme thttpd 2.13 Acme thttpd 2.12 Acme thttpd 2.11 Acme thttpd 2.10 Acme thttpd 2.0.9 Acme thttpd 2.0.8 Acme thttpd 2.0.7 Acme thttpd 2.0.6 Acme thttpd 2.0.5 Acme thttpd 2.0.4 Acme thttpd 2.0.3 Acme thttpd 2.0.2 Acme thttpd 2.0.1 Acme thttpd 2.0 |
| Not Vulnerable: |
tinyproxy tinyproxy 1.5 .0 National Science Foundation Squid Web Proxy 2.4 STABLE4 National Science Foundation Squid Web Proxy 2.4 STABLE3 National Science Foundation Squid Web Proxy 2.4 STABLE2 National Science Foundation Squid Web Proxy 2.4 STABLE1 National Science Foundation Squid Web Proxy 2.4 National Science Foundation Squid Web Proxy 2.3 STABLE5 National Science Foundation Squid Web Proxy 2.3 STABLE4 National Science Foundation Squid Web Proxy 2.3 STABLE3 National Science Foundation Squid Web Proxy 2.3 STABLE2 National Science Foundation Squid Web Proxy 2.3 Astaro Security Linux 3.2 16 Astaro Security Linux 3.2 15 AnWeb AnWeb Proxy 1.37 d AnWeb AnWeb Proxy 1.34 d AnWeb AnWeb Proxy 1.32 f AnWeb AnWeb Proxy 1.31 c AnWeb AnWeb Proxy 1.29 c AnWeb AnWeb Proxy 1.27 c AnWeb AnWeb Proxy 1.25 AnWeb AnWeb Proxy 1.17 AnWeb AnWeb Proxy 1.16 b |
Discussion
Multiple Vendor HTTP CONNECT TCP Tunnel Vulnerability
Multiple software and integrated server packages that function as web proxies may be used as open TCP proxies. This is through the usage of the HTTP CONNECT method by default. This method is detailed in RFC 2817, where it is used to build generic Transit Layer Security over HTTP.
Upon receiving a CONNECT request, vulnerable products act as a TCP proxy, tunneling the conversation. This can be used to launch attacks against internal machines or to, for example, use an internal mail server as an open relay.
In many cases, this behavior may be controlled through the server configuration. Often it is related to support for tunneling or SSL related functionality.
The issue may also introduce an additional threat. Trusted, internal hosts may be able to proxy unauthorized connections to arbitrary ports on external hosts, which may violate security policy.
This vulnerability represents a preliminary list of vendors which may have vulnerable default configurations. Updates will be made as additional information becomes available.
Multiple software and integrated server packages that function as web proxies may be used as open TCP proxies. This is through the usage of the HTTP CONNECT method by default. This method is detailed in RFC 2817, where it is used to build generic Transit Layer Security over HTTP.
Upon receiving a CONNECT request, vulnerable products act as a TCP proxy, tunneling the conversation. This can be used to launch attacks against internal machines or to, for example, use an internal mail server as an open relay.
In many cases, this behavior may be controlled through the server configuration. Often it is related to support for tunneling or SSL related functionality.
The issue may also introduce an additional threat. Trusted, internal hosts may be able to proxy unauthorized connections to arbitrary ports on external hosts, which may violate security policy.
This vulnerability represents a preliminary list of vendors which may have vulnerable default configurations. Updates will be made as additional information becomes available.
Exploit / POC
Multiple Vendor HTTP CONNECT TCP Tunnel Vulnerability
No exploit is required.
No exploit is required.