FKIE_CVE-2009-0803

Vulnerability from fkie_nvd - Published: 2009-03-04 16:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
References
cve@mitre.orghttp://www.kb.cert.org/vuls/id/435052US Government Resource
cve@mitre.orghttp://www.kb.cert.org/vuls/id/MAPG-7M6SM7US Government Resource
cve@mitre.orghttp://www.securityfocus.com/bid/33858Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/435052US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/MAPG-7M6SM7US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/33858Vendor Advisory
Impacted products
Vendor Product Version
smoothwall networkguardian 2008
smoothwall schoolguardian 2008
smoothwall smoothguardian 2008
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:smoothwall:networkguardian:2008:*:*:*:*:*:*:*",
              "matchCriteriaId": "125A7E97-7498-4F4B-BF57-72216059F299",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smoothwall:schoolguardian:2008:*:*:*:*:*:*:*",
              "matchCriteriaId": "056B0BD8-F842-4844-8954-FE1CFC92C6BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:smoothwall:smoothguardian:2008:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4285E19-02DA-4A75-BE6F-F46769FD8A0A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header."
    },
    {
      "lang": "es",
      "value": "SmoothWall SmoothGuardian, usada en SmoothWall Firewall, NetworkGuardian, y SchoolGuardian 2008, cuando el modo de intercepci\u00f3n trasparente est\u00e1 activado, usa la cabecera HTTP Host para determinar el punto final remoto, lo que permite a los atacantes remotos evitar el control de acceso para Flash, Java, Silverlight y propablemente otras tecnolog\u00edas, y posiblemente comunicarse con sitios de intranet retringidos, a trav\u00e9s de p\u00e1ginas web manipuladas lo que causa que el cliente env\u00ede peticiones HTTP con una cabecera Host modificada."
    }
  ],
  "id": "CVE-2009-0803",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-03-04T16:30:00.217",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/435052"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/MAPG-7M6SM7"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/33858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/435052"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/MAPG-7M6SM7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/33858"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.