Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 4 subscribers
  • Views 20908 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTP Proxy CONNECT Loop DoS?

jlbrown

Running a Nessus vulnerability scan on my network, it detects the IP of my Sophos UTM having one:

MEDIUM: HTTP Proxy CONNECT Loop DoS

Description

The proxy allows the users to perform repeated CONNECT requests to itself.

This allow anybody to saturate the proxy CPU, memory or file descriptors.

** Note that if the proxy limits the number of connections
** from a single IP (e.g. acl maxconn with Squid), it is
** protected against saturation and you may ignore this alert.

Solution

Reconfigure your proxy so that it refuses CONNECT requests to itself.

Port   8080 / tcp / http_proxy    

Any ideas how I fix this?

Version 9.404-5

Thanks,

James.



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Jack Daniel

    I've been unable to duplicate this in my labs against a few versions of UTM.

    If the problem continues, or returns, please reach out to me,  This applies to any Nessus (or any other Tenable products) findings, I'm happy to bridge the Sophos and Tenable communities.

    Cheers

    -jd

Children