The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Vulnerability of Symantec EF, SGS: internal IP disclosure via HTTP proxy

Synthesis of the vulnerability 

An attacker can use a special request to HTTP proxy in order to obtain IP addresses hidden by a translation.
Vulnerable software: SEF, SGS.
Severity of this announce: 1/4.
Creation date: 11/05/2006.
Revision date: 12/05/2006.
Références of this computer vulnerability: BID-17936, CVE-2006-2341, SEC Consult SA-20060512-0, SYM06-009, VIGILANCE-VUL-5833.

Description of the vulnerability 

When an IP address is translated, only its public value can be obtained from internet.

The HTTP proxy installed on firewall does not correctly manage malformed requests like:
  getABC/DEF http/1.0
In this case, a timeout occurs and proxy returns an error message like:
Using this request, attacker then obtains the private IP address of web servers located behind proxy.

This vulnerability therefore permits an attacker to obtain information to prepare an intrusion.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This computer threat note impacts software or systems such as SEF, SGS.

Our Vigil@nce team determined that the severity of this weakness alert is low.

The trust level is of type confirmed by the editor, with an origin of internet client.

An attacker with a expert ability can exploit this computer weakness note.

Solutions for this threat 

Symantec EF, SGS: corrected version for HTTP proxy.
Following versions are corrected:
  Symantec Gateway Security 1600 appliance : 3.0
  Symantec Gateway Security 5000 Series : 3.0.1
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service 

Vigil@nce provides application vulnerability patches. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.