[30842] in bugtraq
Apache 1.3.27 mod_proxy security issue
daemon@ATHENA.MIT.EDU (Jason Robertson)
Tue Jul 22 13:35:25 2003
From: "Jason Robertson" <jason@ifuture.com>
To: bugtraq@securityfocus.com
Date: Tue, 22 Jul 2003 12:52:04 -0400
MIME-Version: 1.0
Message-ID: <3F1D3374.19224.720A5F8C@localhost>
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
I have found that recently a spammer has been using a mod_proxy
configuration, (that was meant to allow for an easier transition to a
new naming scheme, as well as changes to a backend software) as a spam
relay.
The spammer has been using HTTP POST requests to send these messages
with POST HTTP://mailserver:25/ HTTP/1.1
With some research it looks like this is an automated process including
the initial scan stage.
When I contacted Apache in regards to this, the response was not very
promising.
This problem would be a simple fix with implementing the AllowConnect
configuration option within proxy_http, to prevent outbound
connections.
Jason
