Description
Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header.
References
- http://sourceforge.net/project/shownotes.php?group_id=68912&release_id=466649
- 30544 vdb-entry
- 22967 third-party-advisory
- 21102 vdb-entry
- 20061113 Chetcpasswd 2.x: multiple vulnerabilities mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454
- chetcpasswd-xforwardedfor-security-bypass(30451) vdb-entry