Description
Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ziproxy | 2.7.2-1 | — |
| Debian 13 | ziproxy | 2.7.2-1 | — |
| Debian 12 | ziproxy | 2.7.2-1 | — |
References
- 33858 vdb-entry
- VU#435052 third-party-advisory
- http://www.kb.cert.org/vuls/id/MAPG-7N9GN8