SB2013090903 - Fedora EPEL 6 update for tinyproxy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013090903

SB2013090903 - Fedora EPEL 6 update for tinyproxy

Published: September 9, 2013 Updated: April 24, 2025

Security Bulletin ID SB2013090903
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Configuration (CVE-ID: CVE-2011-1499)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.


2) Input validation error (CVE-ID: CVE-2011-1843)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers.


Remediation

Install update from vendor's website.

References