On Wed, Oct 5, 2011 at 7:15 PM, Context IS - Disclosure < [email protected]> wrote:
> ===============================ADVISORY============================== > Systems Affected: Apache httpd > Severity: High > Category: Proxy Bypass > Author: Context Information Security Ltd > Reported to vendor: 16th November 2011 > Advisory Issued: 5th October 2011 > Reference: CVE-2011-3368 > ===============================ADVISORY============================== > > It seems that the apache devs couldn't properly fix this: http://marc.info/?l=apache-httpd-dev&m=132205829523882&w=2 "Prutha Parikh from Qualys reported a variant on the CVE-2011-3368 attackagainst certain mod_proxy/mod_rewrite configurations. A new CVE name,CVE-2011-4317, has been assigned to this variant." -- Ferenc Kovács @Tyr43l - http://tyrael.hu
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
