CVE-2006-6982: Medium severity 3proxy 3proxy vulnerability
Published Feb 8, 2007
·Updated
3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC2617 support to use basic cleartext authentication even if NTLM is available, which makes it easier for attackers to steal credentials.
Affected Software
3 affected components
3proxy 3proxy=0.5
3proxy 3proxy=0.5.1
3proxy 3proxy=0.5.2
Event History
Feb 8, 2007
CVE Published
06:28 PM
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-6982?
The severity of CVE-2006-6982 is rated as medium with a score of 5.
2
How does CVE-2006-6982 affect NTLM authentication?
CVE-2006-6982 allows 3proxy to improperly handle NTLM authentication, potentially leading to the use of less secure basic authentication.
3
What versions of 3proxy are impacted by CVE-2006-6982?
CVE-2006-6982 affects 3proxy versions 0.5 to 0.5.2.
4
How can I mitigate the risks associated with CVE-2006-6982?
To mitigate CVE-2006-6982, upgrade to a later version of 3proxy that addresses this authentication issue.
5
What type of attacks can CVE-2006-6982 facilitate?
CVE-2006-6982 can facilitate credential theft attacks due to the potential use of basic cleartext authentication.