[prev in list] [next in list] [prev in thread] [next in thread] 

List:       muffin
Subject:    Forwarded message: Privacy concerns in interMute
From:       "Mark R. Boyns" <boyns () contigo ! com>
Date:       1999-07-19 18:45:23
[Download RAW message or body]

Just wanted to share this with you all in case any of you are using
interMute.

X-From-Line: owner-bugtraq@SECURITYFOCUS.COM  Mon Jul 19 11:04:35 1999
Received: from rodan.contigo.com (root@rodan.contigo.com [209.75.193.2])
	by doctor.contigo.com (8.9.3/8.9.3/Debian/GNU) with ESMTP id LAA17888
	for <boyns@doctor.contigo.com>; Mon, 19 Jul 1999 11:04:35 -0700
Received: from lists.securityfocus.com (lists.securityfocus.com [216.102.46.4])
	by rodan.contigo.com (8.9.3/8.9.3/Debian/GNU) with SMTP id LAA16876
	for <boyns@CONTIGO.COM>; Mon, 19 Jul 1999 11:04:25 -0700
Received: (qmail 12887 invoked from network); 19 Jul 1999 17:52:44 -0000
Received: from lists.securityfocus.com (216.102.46.4)
  by lists.securityfocus.com with SMTP; 19 Jul 1999 17:52:44 -0000
Received: from LISTS.SECURITYFOCUS.COM by LISTS.SECURITYFOCUS.COM
          (LISTSERV-TCP/IP release 1.8d) with spool id 183638 for
          BUGTRAQ@LISTS.SECURITYFOCUS.COM; Mon, 19 Jul 1999 10:51:57 -0700
Approved-By: aleph1@SECURITYFOCUS.COM
Received: from securityfocus.com (216.102.46.2) by lists.securityfocus.com with
          SMTP; 16 Jul 1999 20:59:33 -0000
Received: (qmail 93419 invoked by alias); 16 Jul 1999 20:59:33 -0000
Delivered-To: BUGTRAQ@SECURITYFOCUS.COM
Received: (qmail 93416 invoked from network); 16 Jul 1999 20:59:33 -0000
Received: from calnet11-70.gtecablemodem.com (HELO gw.whitefang.com)
          (trig@207.175.234.70) by securityfocus.com with SMTP; 16 Jul 1999
          20:59:33 -0000
Received: (qmail 15677 invoked from network); 16 Jul 1999 20:59:31 -0000
Received: from jwt.whitefang.com (HELO jwt) (192.168.11.2) by gw.whitefang.com
          with SMTP; 16 Jul 1999 20:59:31 -0000
X-Sender: john@jwt.whitefang.com
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Gnus-Mail-Source: file:~/Mail/spool/incoming
Message-ID:  <Pine.SC5.4.10.9907161355411.1263-100000@jwt.whitefang.com>
Date:         Fri, 16 Jul 1999 13:59:30 -0700
Reply-To: John Temples <john@KUWAIT.NET>
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
From: John Temples <john@KUWAIT.NET>
Subject:      Privacy concerns in interMute
X-To:         BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To:  <9907149319.AA931969217@rd.qms.com>
Lines: 37
Xref: doctor.contigo.com mail.bugtraq:3481

interMute (www.intermute.com) is a junk filter/privacy enhancer for web
browsers.  It runs as either a privileged Java applet within your
browser, or as a standalone Java application.

interMute operates as a proxy server listening on port 4444, and is
meant to operate dedicated to a single user.  It correctly rejects any
service requests from IP addresses not on the local host.  However, it
has no mechanism to determine whether requests coming from the local
host originated from the browsing user, or some other user.

The interMute proxy has a "home page" from which the user can configure
it and view filtering statistics for the current session.  A local user
on a UNIX host can connect to another user's interMute proxy, giving
him full control over interMute.  Thus various attacks and intrusions
are possible:

1) The sites which were acted upon by interMute are listed in the
   "statistics" area, thus revealing part of the user's browsing history;

2) interMute can be configured to chain to another proxy, thus allowing
   all browsing activity to be redirected and logged without the user's
   knowledge;

3) interMute can be configured to load a home page which could contain
   hostile Java and/or JavaScript code;

4) Various denial of service attacks are possible by reconfiguring
   interMute's filters.

I was unable to trick it into handling "file:" URLs or retrieving files
off the disk, except for files in the interMute home directory.

Reported to the vendor on July 9; no reply received.

--
John W. Temples, III



[prev in list] [next in list] [prev in thread] [next in thread]