junkbuster: Attacker might be able to modify settings

Debian Bug report logs - #304793
junkbuster: Attacker might be able to modify settings

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Helge Kreutzmann <kreutzm@itp.uni-hannover.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: junkbuster: Attacker might be able to modify settings

Date: Fri, 15 Apr 2005 16:20:30 +0200

Package: junkbuster
Version: 2.0.2-0.2
Severity: grave
Tags: security, woody
Justification: user security hole

According to 
http://lwn.net/Alerts/131964/ 

JunkBuster is vulnerable to a heap corruption vulnerability, and under
certain configurations may allow an attacker to modify settings.

Impact
======

If JunkBuster has been configured to run in single-threaded mode, an
attacker can disable or modify the filtering of Referrer: HTTP
headers,
potentially compromising the privacy of users. The heap corruption
vulnerability could crash or disrupt the operation of the proxy,
potentially executing arbitrary code.


The fix can probably taken from the above Gentoo security advisory.

You might want to track http://lwn.net/Articles/131972/ for other
vendors responses.

Please also check if the successor, privoxy, is impacted as well.


-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux pleione 2.4.26-grsec #1 Tue Aug 10 15:42:40 CEST 2004 i686
Locale: LANG=en_US, LC_CTYPE=en_US

Message #10 received at 304793@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: kreutzm@itp.uni-hannover.de

Cc: 304793@bugs.debian.org

Subject: junkbuster issue was already adressed by DSA-713

Date: Wed, 2 Nov 2005 10:24:44 +0100

Hi,
this issue is CVE-2005-1109 and was addressed by DSA-713 from 2005-04-13.
Do you have reason to believe that the fix used there was incomplete?

Cheers,
        Moritz

Message #15 received at 304793-done@bugs.debian.org (full text, mbox, reply):

From: Helge Kreutzmann <kreutzm@itp.uni-hannover.de>

To: Moritz Muehlenhoff <jmm@inutil.org>

Cc: 304793-done@bugs.debian.org

Subject: Re: junkbuster issue was already adressed by DSA-713

Date: Sat, 5 Nov 2005 17:45:37 +0100

[Message part 1 (text/plain, inline)]

Version: 2.0.2-0.2woody1

Hello Moritz,
On Wed, Nov 02, 2005 at 10:24:44AM +0100, Moritz Muehlenhoff wrote:
> this issue is CVE-2005-1109 and was addressed by DSA-713 from 2005-04-13.
> Do you have reason to believe that the fix used there was incomplete?

(actually CVE-2005-1108 as well). No, I simply missed it. Thus
closing.

Greetings

            Helge


-- 
Dr. Helge Kreutzmann, Dipl.-Phys.           Helge.Kreutzmann@itp.uni-hannover.de
                       gpg signed mail preferred 
    64bit GNU powered                  http://www.itp.uni-hannover.de/~kreutzm
          Help keep free software "libre": http://www.ffii.de/

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.