jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - privoxy: several use-after-free issues in list.c (CVE-2015-1031)

  - privoxy: invalid read via empty host header in client request (CVE-2016-1983)

  - Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the     client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy     service via a 407 (aka Proxy Authentication Required) HTTP status code. (CVE-2013-2503)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Privoxy Developers reports :

Fixed a DoS issue in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort(). Reported by Matthew Daley. CVE-2015-1380.

Fixed multiple segmentation faults and memory leaks in the pcrs code.
This fix also increases the chances that an invalid pcrs command is rejected as such. Previously some invalid commands would be loaded without error. Note that Privoxy's pcrs sources (action and filter files) are considered trustworthy input and should not be writable by untrusted third-parties. CVE-2015-1381.

Fixed an 'invalid read' bug which could at least theoretically cause Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.

According to its self-reported version number, the version of Privoxy running on the remote host is prior to 3.0.23. It is, therefore, potentially affected by multiple denial of service vulnerabilities :

  - A flaw exists in the chunked_body_is_complete() function     in 'jcc.c' due to improper processing of invalid     chunk-encoded bodies. A remote attacker, using a     specially crafted client request, can cause the Privoxy     instance to abort. (CVE-2015-1380)

  - Multiple flaws exist in the pcrs_compile_replacement()     function in 'pcrs.c' when handling backreferences.
    Remote attackers can exploit these flaws to cause a     segmentation fault or memory consumption.
    (CVE-2015-1381)

  - An invalid read flaw in 'parsers.c' allows a remote     attacker, via an HTTP request with a specially-crafted     time header, to cause a denial of service condition.
    (CVE-2015-1382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

privoxy was updated to version 3.0.23 to fix three security issues.

These security issues were fixed :

  - Fixed a DoS issue in case of client requests with     incorrect chunk-encoded body. When compiled with     assertions enabled (the default) they could previously     cause Privoxy to abort() (CVE-2015-1380).

  - Fixed multiple segmentation faults and memory leaks in     the pcrs code. This fix also increases the chances that     an invalid pcrs command is rejected as such     (CVE-2015-1381).

  - Client requests with body that can't be delivered no     longer cause pipelined requests behind them to be     rejected as invalid (CVE-2015-1382).

ID	Name	Product	Family	Severity
199404	RHEL 5 : privoxy (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
88153	FreeBSD : privoxy -- multiple vulnerabilities (d9e1b569-c3d8-11e5-b5fe-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
81516	Privoxy < 3.0.23 Multiple DoS Vulnerabilities	Nessus	Firewalls	medium
81241	openSUSE Security Update : privoxy (openSUSE-2015-115)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2015-1380

high

Tenable Plugins

high

medium

medium

medium