Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Gentoo: 201312-15 Normal: Tinyproxy Denial of Service Risk

gentoo
Calendar Grey December 23, 2013
Dist Gentoo Esm H88
The Tinyproxy flaw reported in Gentoo GLSA 201312-15 leads to a potential Denial of Service attack. Users are strongly advised to apply updates without delay.
A vulnerability has been found in Tinyproxy, allows remote attackers to cause a Denial of Service condition.

Summary

A vulnerability has been discovered in the way how Tinyproxy works with headers.

Topics%20covered

Topics Covered

security advisory denial of service gentoo remote attack tinyproxy

Resolution

All Tinyproxy users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/tinyproxy-1.8.3-r3"

References

[ 1 ] CVE-2012-3505 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3505

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201312-15
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: Tinyproxy: Denial of Service
Date: December 23, 2013
Bugs: #432046
ID: 201312-15

Topics%20covered

Topics Covered

security advisory denial of service gentoo remote attack tinyproxy

Synopsis

A vulnerability has been found in Tinyproxy, allows remote attackers to cause a Denial of Service condition.

Background

Tinyproxy is a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-proxy/tinyproxy < 1.8.3-r3 >= 1.8.3-r3

Impact

===== A remote attacker could send a specially crafted request with too many headers, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.

Your message here