|
AdSubtract Unauthorised Proxy Access
|
|
Secunia Advisory:
|
SA8950
|
|
|
Release Date:
|
2003-06-05
|
|
Popularity:
|
4,882 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | AdSubtract 2.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
A vulnerability has been identified in AdSubtract allowing malicious people to use the proxy functionality of AdSubtract.
The problem is that AdSubtract by default listens on 4444/tcp and 11523/tcp on all interfaces, by default AdSubtract also filters access so that only requests from 127.0.0.1 are allowed. However, this security mechanism is flawed, anyone who can alter the PTR DNS record for hes IP address so that the hostname becomes "127.0.0.1.somedomain" can fool the "security" check.
This could be exploited by malicious people to perform arbitrary connections from hosts running AdSubtract. This includes SMTP connections allowing unauthorised mail relaying.
Solution:
Filter access at your perimeter or use a personal firewall to prevent malicious people from connecting to the service.
Provided and/or discovered by:
LURHQ
Original Advisory:
http://www.lurhq.com/advisory20030604.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
