CVE-2009-0804

NameCVE-2009-0804
DescriptionZiproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs521051

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ziproxy (PTS)jessie3.2.0-2fixed
buster, bullseye, stretch, sid3.3.1-2.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ziproxysource(unstable)2.7.2-1low521051

Notes

[lenny] - ziproxy <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems