Bug 166523 - CAN-2004-2480 squid access control bypass
Summary: CAN-2004-2480 squid access control bypass
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: squid
Version: 4
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
Assignee: Martin Stransky
QA Contact:
URL:
Whiteboard: impact=low,reported=20050821,public=2...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-08-22 20:23 UTC by Josh Bressers
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-08-29 10:00:25 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Josh Bressers 2005-08-22 20:23:33 UTC
+++ This bug was initially created as a clone of Bug #166522 +++

This issue was discovered by Nuno Costa:
http://archives.neohapsis.com/archives/bugtraq/2004-05/0070.html


hello

im not a expert in this area, but i work in a intranet that haves the
Squid/2.3.STABLE5 filtring all access's to the internet..

so i don't have access to the internet directaly, but i know that this proxy
allow access to especific web sites.. so, in the past if i us this:
http://urlwebsite_allowed.pt -> the vuln that is already discovered... i have
access to the website that i want...
but in this days, this vuln is now fixed so...
in my test's i found this way to pass this proxy, using:
http://website_allowed.ptmy_url -> now i have access...
using url.pt i can bypass the proxy and access the internet, i don't know how
faur, this could go!!
so i don't know if this is a bug from IE or just a simple bug from Squid.. ???
can anyone tell what we have in hands ?

Comment 1 Josh Bressers 2005-08-22 20:24:20 UTC
This issue should also affect FC3

Comment 2 Martin Stransky 2005-08-29 10:00:25 UTC
The original reporter hasn't replied and I can't reproduce it, so I'm closing it
as WORKSFORME. Please reopen if you find more info...


Note You need to log in before you can comment on or make changes to this bug.