Description
TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
References
- [or-talk] 20071031 Insecure Privoxy Configuration in Vidalia Bundles Prior to 0.1.2.18 mailing-list
- [or-talk] 20071031 Re: Insecure Privoxy Configuration in Vidalia Bundles Prior to 0.1.2.18 mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=551544&group_id=159836
- tork-privoxy-security-bypass(42280) vdb-entry
- 48694 vdb-entry
- 26386 vdb-entry