News
Vigil@nce: Links, proxy bypassing
July 2008 by Vigil@nce
SYNTHESIS
An attacker can invite the victim to open an application bypassing
the proxy even if the only-proxies option of Links is set.
Gravity: 1/4
Consequences: data reading, data flow
Provenance: internet server
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: medium (2/3)
Creation date: 28/07/2008
Identifier: VIGILANCE-VUL-7973
IMPACTED PRODUCTS
– Slackware Linux [confidential versions]
– Unix - plateform
DESCRIPTION
The "Links" browser purposes the "only-proxies" option to force
flows to pass through a proxy.
When this option is enabled, FTP, HTTP, HTTPS go through the
proxy. However the mms, telnet, smb, tn3270, finger and mailto are
handled by an external program which can be configured to not use
a proxy.
An attacker can therefore invite the victim to open an application
bypassing the proxy even if the only-proxies option of Links is
set.
CHARACTERISTICS
Identifiers: CVE-2008-3329, SSA:2008-210-04, VIGILANCE-VUL-7973
