bugtraq - Re: Fwd: IE 5.x keep-alive session hijacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 4 Sep 2003 22:22:36 +0200
From: Waldo Bastian <bastian@....org>
To: "Domas Mituzas" <Domas.Mituzas@...rolink.lt>
Cc: <bugtraq@...urityfocus.com>
Subject: Re: Fwd: IE 5.x keep-alive session hijacking


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 04 September 2003 17:45, you wrote:
> Hi,
>
> sorry for being innacurate, but I noticed that our transparent-proxy system
> is trying (and even to succeeds at some level) to hijack client http
> connections.

Sounds like a bug in your proxy that it doesn't filter the Proxy-Connection 
headers out.

See e.g. http://ftp.ics.uci.edu/pub/ietf/http/hypermail/1999/0040.html

Cheers,
Waldo
- -- 
bastian@....org -=|[ SuSE, The Linux Desktop Experts ]|=- bastian@...e.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE/V58NN4pvrENfboIRAub0AKCOIiBtyN+wXvIPr64RZMM92KaQ8gCfdlP2
EbxkGX0XmCu8owndG2cfLVo=
=Bo7H
-----END PGP SIGNATURE-----