CVE-2008-4133 - Vulnerability Details - OpenCVE

The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
D-link	Dir-100

Configuration 1 [-]

OR	cpe:2.3:h:d-link:dir-100:1.02:::::::*
	cpe:2.3:h:d-link:dir-100:1.12:::::::*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html
http://secunia.com/advisories/31767
http://securityreason.com/securityalert/4276
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808
http://www.securityfocus.com/archive/1/496072/100/0/threaded
http://www.securityfocus.com/bid/31050
http://www.securitytracker.com/id?1020825
https://exchange.xforce.ibmcloud.com/vulnerabilities/44961

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-09-19T17:04:00

Updated: 2024-08-07T10:08:34.197Z

Reserved: 2008-09-19T00:00:00

Link: CVE-2008-4133

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-09-19T17:15:05.593

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-4133

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-09-08T00:00:00", "descriptions": [{"lang": "en", "value": "The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "31050", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/31050"}, {"name": "31767", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/31767"}, {"name": "20080908 [scip_Advisory 3808] D-Link DIR-100 long url filter evasion", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html"}, {"tags": ["x_refsource_MISC"], "url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808"}, {"name": "4276", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4276"}, {"name": "dlink-dir100-webproxyfilter-security-bypass(44961)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44961"}, {"name": "1020825", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1020825"}, {"name": "20080908 [scip_Advisory 3808] D-Link DIR-100 long url filter evasion", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/496072/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-4133", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "31050", "refsource": "BID", "url": "http://www.securityfocus.com/bid/31050"}, {"name": "31767", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/31767"}, {"name": "20080908 [scip_Advisory 3808] D-Link DIR-100 long url filter evasion", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html"}, {"name": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808", "refsource": "MISC", "url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808"}, {"name": "4276", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4276"}, {"name": "dlink-dir100-webproxyfilter-security-bypass(44961)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44961"}, {"name": "1020825", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1020825"}, {"name": "20080908 [scip_Advisory 3808] D-Link DIR-100 long url filter evasion", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/496072/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:08:34.197Z"}, "title": "CVE Program Container", "references": [{"name": "31050", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/31050"}, {"name": "31767", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/31767"}, {"name": "20080908 [scip_Advisory 3808] D-Link DIR-100 long url filter evasion", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808"}, {"name": "4276", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/4276"}, {"name": "dlink-dir100-webproxyfilter-security-bypass(44961)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44961"}, {"name": "1020825", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1020825"}, {"name": "20080908 [scip_Advisory 3808] D-Link DIR-100 long url filter evasion", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/496072/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-4133", "datePublished": "2008-09-19T17:04:00", "dateReserved": "2008-09-19T00:00:00", "dateUpdated": "2024-08-07T10:08:34.197Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:d-link:dir-100:1.02:*:*:*:*:*:*:*", "matchCriteriaId": "35434946-565C-4756-BB73-BD1A02566999", "vulnerable": true}, {"criteria": "cpe:2.3:h:d-link:dir-100:1.12:*:*:*:*:*:*:*", "matchCriteriaId": "866C86B9-9CE9-45CC-BECF-1B00869ABE14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters."}, {"lang": "es", "value": "El servicio web proxy en el D-Link DIR-100 con firmware 1.12 y anteriores no filtra de manera apropiada las peticiones web con URLs de mucha longitud, permite a atacantes remotos evitar los filtros de restricci\u00f3n web."}], "id": "CVE-2008-4133", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-09-19T17:15:05.593", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/31767"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4276"}, {"source": "cve@mitre.org", "url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/496072/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/31050"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1020825"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44961"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/31767"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/4276"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/496072/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/31050"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1020825"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44961"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}