Apache 1.3.27 mod_proxy security issue

From: Jason Robertson (jasonat_private)
Date: Tue Jul 22 2003 - 09:52:04 PDT

Next message: Lincoln Stein: "Re: CGI.pm vulnerable to Cross-site Scripting"

Previous message: voleurat_private: "Re: Microsoft Windows 2000 RPC DCOM Interface DOS AND Privilege Escalation Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I have found that recently a spammer has been using a mod_proxy 
configuration, (that was meant to allow for an easier transition to a 
new naming scheme, as well as changes to a backend software) as a spam 
relay.  
The spammer has been using HTTP POST requests to send these messages
with POST http://mailserver:25/ HTTP/1.1  
With some research it looks like this is an automated process including 
the initial scan stage.

When I contacted Apache in regards to this, the response was not very 
promising. 

This problem would be a simple fix with implementing the AllowConnect 
configuration option within proxy_http, to prevent outbound 
connections.  

Jason

Next message: Lincoln Stein: "Re: CGI.pm vulnerable to Cross-site Scripting"
Previous message: voleurat_private: "Re: Microsoft Windows 2000 RPC DCOM Interface DOS AND Privilege Escalation Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Jul 22 2003 - 10:30:21 PDT