Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - privoxy: several use-after-free issues in list.c (CVE-2015-1031)

  - privoxy: invalid read via empty host header in client request (CVE-2016-1983)

  - Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the     client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy     service via a 407 (aka Proxy Authentication Required) HTTP status code. (CVE-2013-2503)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Privoxy Developers reports :

Proxy authentication headers are removed unless the new directive enable-proxy-authentication-forwarding is used. Forwarding the headers potentially allows malicious sites to trick the user into providing them with login information. Reported by Chris John Riley.

privoxy was updated to 3.0.21 stable fo fix CVE-2013-2503 (bnc#809123)

  - changes in 3.0.21

  - On POSIX-like platforms, network sockets with file     descriptor values above FD_SETSIZE are properly     rejected. Previously they could cause memory corruption     in configurations that allowed the limit to be reached.

  - Proxy authentication headers are removed unless the new     directive enable-proxy-authentication-forwarding is     used. Forwarding the headers potentionally allows     malicious sites to trick the user into providing them     with login information. Reported by Chris John Riley.

  - Compiles on OS/2 again now that unistd.h is only     included on platforms that have it.

  - The show-status page shows the     FEATURE_STRPTIME_SANITY_CHECKS status.

  - A couple of assert()s that could theoretically     dereference NULL pointers in debug builds have been     relocated.

  - Added an LSB info block to the generic start script.
    Based on a patch from Natxo Asenjo.

  - The max-client-connections default has been changed to     128 which should be more than enough for most setups.

  - Block rover.ebay./ar.*\&adtype= instead of     '/.*\&adtype=' which caused too man false positives.
    Reported by u302320 in #360284, additional feedback from     Adam Piggott.

  - Unblock '.advrider.com/' and '/.*ADVrider'. Anonymously     reported in #3603636.

  - Stop blocking '/js/slider\.js'. Reported by Adam Piggott     in #3606635 and _lvm in #2791160.

  - Added an iframes filter.

  - The whole GPLv2 text is included in the user manual now,     so Privoxy can serve it itself and the user can read it     without having to wade through GPLv3 ads first.

  - Properly numbered and underlined a couple of section     titles in the config that where previously overlooked     due to a flaw in the conversion script. Reported by Ralf     Jungblut.

  - Improved the support instruction to hopefully make it     harder to unintentionally provide insufficient     information when requesting support. Previously it     wasn't obvious that the information we need in bug     reports is usually also required in support requests.

  - Removed documentation about packages that haven't been     provided in years.

  - Only log the test number when not running in verbose     mode The position of the test is rarely relevant and it     previously

  - for full list of changes see ChangeLog file shipped     together with this package

According to its self-identified version number, the Privoxy installed on the remote host is a version prior to 3.0.21. It is, therefore, affected by multiple information disclosure vulnerabilities due to the application not properly handling Proxy-Authenticate and Proxy-Authorization headers. This can allow a remote, malicious HTTP server to spoof the intended proxy service via a 407 (Proxy Authentication Required) HTTP status code and thereby gain access to user credentials.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-2503 to the following vulnerability :

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199404	RHEL 5 : privoxy (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
88152	FreeBSD : privoxy -- malicious server spoofing as proxy vulnerability (ad82b0e9-c3d6-11e5-b5fe-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
74941	openSUSE Security Update : privoxy (openSUSE-2013-242)	Nessus	SuSE Local Security Checks	medium
65948	Privoxy < 3.0.21 Multiple Information Disclosure Vulnerabilities	Nessus	Firewalls	medium
65649	Fedora 17 : privoxy-3.0.21-1.fc17 (2013-3756)	Nessus	Fedora Local Security Checks	medium
65648	Fedora 18 : privoxy-3.0.21-1.fc18 (2013-3753)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2503

high

Tenable Plugins

high

medium

medium

medium

medium

medium