Full Disclosure mailing list archives
Re: Context IS Advisory - Apache Reverse Proxy Bypass Vulnerability
From: Ferenc Kovacs <tyra3l () gmail com>
Date: Mon, 28 Nov 2011 12:09:12 +0100
On Wed, Oct 5, 2011 at 7:15 PM, Context IS - Disclosure < disclosure () contextis co uk> wrote:
===============================ADVISORY============================== Systems Affected: Apache httpd Severity: High Category: Proxy Bypass Author: Context Information Security Ltd Reported to vendor: 16th November 2011 Advisory Issued: 5th October 2011 Reference: CVE-2011-3368 ===============================ADVISORY==============================
It seems that the apache devs couldn't properly fix this: http://marc.info/?l=apache-httpd-dev&m=132205829523882&w=2 "Prutha Parikh from Qualys reported a variant on the CVE-2011-3368 attackagainst certain mod_proxy/mod_rewrite configurations. A new CVE name,CVE-2011-4317, has been assigned to this variant." -- Ferenc Kovács @Tyr43l - http://tyrael.hu
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Context IS Advisory - Apache Reverse Proxy Bypass Vulnerability Ferenc Kovacs (Nov 28)