Privoxy < 3.0.21 Multiple Information Disclosure Vulnerabilities

medium Nessus Plugin ID 65948

Language:

Synopsis

The remote web proxy is affected by multiple information disclosure vulnerabilities.

Description

According to its self-identified version number, the Privoxy installed on the remote host is a version prior to 3.0.21. It is, therefore, affected by multiple information disclosure vulnerabilities due to the application not properly handling Proxy-Authenticate and Proxy-Authorization headers. This can allow a remote, malicious HTTP server to spoof the intended proxy service via a 407 (Proxy Authentication Required) HTTP status code and thereby gain access to user credentials.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to version 3.0.21 or later.

Plugin Details

Severity: Medium

ID: 65948

File Name: privoxy_3_0_21.nasl

Version: 1.8

Type: remote

Family: Firewalls

Published: 4/12/2013

Updated: 11/27/2019

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2013-2503

Vulnerability Information

CPE: cpe:/a:privoxy:privoxy

Required KB Items: www/Privoxy, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/10/2013

Vulnerability Publication Date: 3/11/2013

Reference Information

CVE: CVE-2013-2503

BID: 58425

Detections

Analytics