UMN GopherD Unauthorized Proxy Vulnerability

Bugtraq ID:	6782
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 27 1996 12:00AM
Updated:	Aug 27 1996 12:00AM
Credit:	Discovery of this issue is credited to Benjamin Wayne Camp <[email protected]>.
Vulnerable:	University of Minnesota gopherd 2.0.4 University of Minnesota gopherd 2.0.3 University of Minnesota gopherd 2.0 + University of Minnesota gopherd 1.12 s University of Minnesota gopherd 1.12 S University of Minnesota gopherd 1.12
Not Vulnerable:

UMN GopherD Unauthorized Proxy Vulnerability

UMN gopherd is prone to a vulnerability which may allow a remote attacker to proxy a connection to another host. Instead of requesting a local document from the gopher server, it is possible to request the address of an external site. It has been demonstrated that this issue may be exploited to access external FTP servers anonymously.

It is not known exactly which versions are affected by this vulnerability.

UMN GopherD Unauthorized Proxy Vulnerability

This issue may be exploited with a gopher client.

UMN GopherD Unauthorized Proxy Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

UMN GopherD Unauthorized Proxy Vulnerability

References:

• Potential Gopher Exploit (Benjamin Wayne Camp )