Junkbusters Information for VU#150227

HTTP proxy default configurations allow arbitrary TCP connections

Status

Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The default configuration of Internet Junkbuster 2.0.2 only blocks access to port 23/tcp, but also only listens to the loopback interface (127.0.0.1). Access to other TCP ports can be restricted as specified in the Internet Junkbuster FAQ. Previous versions of Junkbuster may by default listen on all interfaces (INADDR ANY) without an adequate ACL.

If you have feedback, comments, or additional information about this vulnerability, please send us email.