CVE-2009-0801
Priority
Low
Description
Squid, when transparent interception mode is enabled, uses the HTTP Host
header to determine the remote endpoint, which allows remote attackers to
bypass access controls for Flash, Java, Silverlight, and probably other
technologies, and possibly communicate with restricted intranet sites, via
a crafted web page that causes a client to send HTTP requests with a
modified Host header.
header to determine the remote endpoint, which allows remote attackers to
bypass access controls for Flash, Java, Silverlight, and probably other
technologies, and possibly communicate with restricted intranet sites, via
a crafted web page that causes a client to send HTTP requests with a
modified Host header.
Bugs
Notes
mdeslaur> as of 2010-02-12, doesn't appear to have an upstream fix.
sbeattie> according to squid bug report, fixed in squid 3.2, which
sbeattie> hasn't us yet; bug report notes to *not* backport fix
sarnold> as of 2013-01-28, doesn't appear to have an upstream fix for <3.2
sbeattie> according to squid bug report, fixed in squid 3.2, which
sbeattie> hasn't us yet; bug report notes to *not* backport fix
sarnold> as of 2013-01-28, doesn't appear to have an upstream fix for <3.2
Package
| Upstream: | needs-triage |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life) |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
| Ubuntu 13.10 (Saucy Salamander): | DNE |
Package
| Upstream: | needs-triage |
| Ubuntu 10.04 LTS (Lucid Lynx): | deferred (2013-02-01) |
| Ubuntu 12.04 LTS (Precise Pangolin): | deferred (2013-02-01) |
| Ubuntu 12.10 (Quantal Quetzal): | deferred (2013-02-01) |
| Ubuntu 13.04 (Raring Ringtail): | needed |
| Ubuntu 13.10 (Saucy Salamander): | needed |