bugtraq - Apache 1.3.27 mod_proxy security issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F1D3374.19224.720A5F8C@localhost>
Date: Tue, 22 Jul 2003 12:52:04 -0400
From: "Jason Robertson" <jason@...ture.com>
To: bugtraq@...urityfocus.com
Subject: Apache 1.3.27 mod_proxy security issue

I have found that recently a spammer has been using a mod_proxy 
configuration, (that was meant to allow for an easier transition to a 
new naming scheme, as well as changes to a backend software) as a spam 
relay.  
The spammer has been using HTTP POST requests to send these messages
with POST HTTP://mailserver:25/ HTTP/1.1  
With some research it looks like this is an automated process including 
the initial scan stage.

When I contacted Apache in regards to this, the response was not very 
promising. 

This problem would be a simple fix with implementing the AllowConnect 
configuration option within proxy_http, to prevent outbound 
connections.  

Jason