Secunia

A vulnerability has been identified in AdSubtract allowing malicious people to use the proxy functionality of AdSubtract.

The problem is that AdSubtract by default listens on 4444/tcp and 11523/tcp on all interfaces, by default AdSubtract also filters access so that only requests from 127.0.0.1 are allowed. However, this security mechanism is flawed, anyone who can alter the PTR DNS record for hes IP address so that the hostname becomes "127.0.0.1.somedomain" can fool the "security" check.

This could be exploited by malicious people to perform arbitrary connections from hosts running AdSubtract. This includes SMTP connections allowing unauthorised mail relaying.

Solution
Filter access at your perimeter or use a personal firewall to prevent malicious people from connecting to the service.

Provided and/or discovered by
LURHQ

Original Advisory
http://www.lurhq.com/advisory20030604.html

Deep Links
Links available in Customer Area