CSO Lanifex Outreach Project Tool Request Origin Spoofing Vulnerability

Bugtraq ID:	6630
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 16 2003 12:00AM
Updated:	Jan 16 2003 12:00AM
Credit:	Vulnerability discovery credited to Martin Eiszner <[email protected]>.
Vulnerable:	CSO Lanifex Outreach Project Tool 0.946 b
Not Vulnerable:

CSO Lanifex Outreach Project Tool Request Origin Spoofing Vulnerability

It has been reported that OPT accepts the values supplied supplied by users in HTTP headers as the originating IP address of a request. It is possible for a remote host to supply a fake IP address in one of these environment variables that would obscure the origin on the request.

CSO Lanifex Outreach Project Tool Request Origin Spoofing Vulnerability

Exploit contributed by Martin Eiszner <[email protected]>:

• /data/vulnerabilities/exploits/optvia.pl

CSO Lanifex Outreach Project Tool Request Origin Spoofing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CSO Lanifex Outreach Project Tool Request Origin Spoofing Vulnerability

References:

• Outreach Project Tool (CSO Lanifex)
  
• Outreach Project Tool (Martin Eiszner )