Summary
The remote host is missing an update to tinyproxy
announced via advisory DSA 145-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20145-1
Insight
The authors of tinyproxy, a lightweight HTTP proxy, discovered a bug in the handling of some invalid proxy requests. Under some circumstances, an invalid request may result in a allocated memory being freed twice. This can potentially result in the execution of arbitrary code.
This problem has been fixed in version 1.4.3-2woody2 for the current stable distribution (woody) and in version 1.4.3-3 for the unstable distribution (sid). The old stable distribution (potato) is not affected by this problem.
We recommend that you upgrade your tinyproxy package immediately.
Severity
Classification
-
CVE CVE-2002-0847 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities