CVE-2011-1499: Low severity tinyproxy vulnerability
acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.
Other sources
It was reported [1] that tinyproxy prior to version 1.8.3, when configured to allow a network range (i.e. "Allow 192.168.0.0/24" versus the default "Allow 127.0.0.1"), would allow any connections from any IP address, turning it into an open proxy. If tinyproxy were configured with one or more Allow statements that use an IP range, this would occur.
This has been fixed upstream [2] and affects the versions of tinyproxy as provided by Fedora and EPEL.
[1] https://banu.com/bugzilla/showbug.cgi?id=90 [2] https://banu.com/cgit/tinyproxy/commit/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1499?
CVE-2011-1499 is considered a medium severity vulnerability due to its potential to allow unauthorized access via an open HTTP proxy.
How do I fix CVE-2011-1499?
To fix CVE-2011-1499, update Tinyproxy to version 1.8.3 or later, which addresses this vulnerability.
What types of systems are affected by CVE-2011-1499?
CVE-2011-1499 affects various versions of Tinyproxy prior to 1.8.3 running on systems that utilize allow configuration settings with CIDR blocks.
What is the impact of exploiting CVE-2011-1499?
Exploiting CVE-2011-1499 allows remote attackers to obscure the origin of web traffic, potentially facilitating malicious activity.
Are there any known exploits for CVE-2011-1499?
While specific exploits for CVE-2011-1499 have not been widely reported, the nature of the vulnerability poses risks if not mitigated.