CVE-2009-0801

Priority
Low
Description
Squid, when transparent interception mode is enabled, uses the HTTP Host
header to determine the remote endpoint, which allows remote attackers to
bypass access controls for Flash, Java, Silverlight, and probably other
technologies, and possibly communicate with restricted intranet sites, via
a crafted web page that causes a client to send HTTP requests with a
modified Host header.
References
Bugs
Notes
sbeattie> according to squid bug report, fixed in squid 3.2, which
sbeattie> hasn't us yet; bug report notes to *not* backport fix
mdeslaur> upstream doesn't consider the issue important enough to create
mdeslaur> a fix for <3.2. We aren't going to fix either.
Package
Source: squid (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life)
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Upstream:needs-triage
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life)
Ubuntu 12.04 LTS (Precise Pangolin):ignored
Ubuntu 12.10 (Quantal Quetzal):ignored
Ubuntu 13.04 (Raring Ringtail):ignored
Ubuntu 13.10 (Saucy Salamander):ignored
More Information

Valid XHTML 1.0 Strict

Updated: 2013-07-16 16:15:02 UTC (commit 7096)