Tinyproxy ACL Security Bypass Vulnerability

Bugtraq ID:	47276
Class:	Access Validation Error
CVE:	CVE-2011-1499
Remote:	Yes
Local:	No
Published:	Apr 08 2011 12:00AM
Updated:	Apr 13 2015 09:33PM
Credit:	PhobosK
Vulnerable:	Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Banu Systems Private Limited Tinyproxy 1.8.2
Not Vulnerable:	Banu Systems Private Limited Tinyproxy 1.8.3

Tinyproxy ACL Security Bypass Vulnerability

Tinyproxy is prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions and gain unauthorized access to the application. This may aid in further attacks.

Tinyproxy 1.8.2 is vulnerable; other versions may also be affected.

Tinyproxy ACL Security Bypass Vulnerability

An attacker can exploit this issue via a browser.

Tinyproxy ACL Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Tinyproxy ACL Security Bypass Vulnerability

References:

• Tinyproxy Homepage (Banu Systems Private Limited)
  
• Banu Git / tinyproxy (Banu Systems Private Limited)
  
• Banu Security Advisory (Banu Systems Private Limited)