|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
DeleGate Information for VU#150227
| Date Notified | |
| Date Modified | 06/29/2004 06:27:59 PM |
| Status Summary | Not Vulnerable |
Vendor StatementWhen DeleGate is running as a HTTP proxy server, it allows only port 443 and 564 as the destination port of the CONNECT method, by default. When DeleGate relays a request with a header, it removes malformed header fields like "RCPT To:..." for example (illegal space in this case). And when DeleGate is relaying to a non-HTTP but privileged port, it tries to detect greeting message from non-HTTP server before relaying a request to it. If the server returns non-HTTP response like "220 ready" within a specified time period, then the request is rejected without forwarded to the server. These mechanisms have been available since 1999 (after DeleGate version 6).US-CERT AddendumPlease see the Access control section of the DeleGate manual.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
