[Full-disclosure] [ GLSA 200606-05 ] Pound: HTTP request smuggling



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200606-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Pound: HTTP request smuggling
Date: June 07, 2006
Bugs: #118541
ID: 200606-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Pound is vulnerable to HTTP request smuggling, which could be exploited
to bypass security restrictions or poison web caches.

Background
==========

Pound is a reverse proxy, load balancer and HTTPS front-end. It allows
to distribute the load on several web servers and offers a SSL wrapper
for web servers that do not support SSL directly.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-servers/pound < 2.0.5 >= 2.0.5

Description
===========

Pound fails to handle HTTP requests with conflicting "Content-Length"
and "Transfer-Encoding" headers correctly.

Impact
======

An attacker could exploit this vulnerability by sending HTTP requests
with specially crafted "Content-Length" and "Transfer-Encoding" headers
to bypass certain security restrictions or to poison the web proxy
cache.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Pound users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/pound-2.0.5"

References
==========

[ 1 ] CVE-2005-3751
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3751

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-05.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Attachment: pgpnvsIFgdFms.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • [ GLSA 200606-05 ] Pound: HTTP request smuggling
    ... Pound is vulnerable to HTTP request smuggling, ... to bypass security restrictions or poison web caches. ... for web servers that do not support SSL directly. ...
    (Bugtraq)
  • [TOOL] Pound - Reverse-Proxy and Load-Balancer
    ... Get your security news from a reliable source. ... The Pound program is a reverse ... it will distribute the requests from the client ... one connection even if the back-end server is HTTP/1.0. ...
    (Securiteam)
  • WhiteHat Arsenal 1.06 Beta Released
    ... fitted with an HTTP Response Code lookup utility. ... WHArsenal the best web application security product available. ... WhiteHat Arsenal logs all HTTP Request activities in either XML or HTML ... The Session Manager keeps log files ...
    (SecProg)
  • WhiteHat Arsenal 1.05 Beta Release
    ... to be a generic web application security productivity tool, ... HTTP Request Header Manipulation ... tremendous support and feedback. ... The Session Manager keeps log files ...
    (SecProg)
  • [Full-disclosure] [ GLSA 200504-29 ] Pound: Buffer overflow vulnerability
    ... Pound is vulnerable to a buffer overflow that could lead to the remote ... Pound is a reverse proxy, ... the Gentoo Security Website: ... Security is a primary focus of Gentoo Linux and ensuring the ...
    (Full-Disclosure)