Does CERNs httpd have any vulnerabilities?
CERN does access restriction using either IP addresses or hostnames. The pattern for both is value.value.value.value, that is 205.42.*.* or *.spy.spook.gov. Since they use some of the same code in their checking, under certain conditions a hole opens. You could spoof or supply a hostname that matches the IP address mask and allows access. If the CERN httpd server is a proxy on a gateway machine and you use IP address masks to limit access to the proxy, an attacker could use the proxied service to access internal machines. Since you are allowing port 80 traffic in, your firewall becomes useless. Admins, a patch should be at from http://softway.com.au/misc/cern.html, and hackers, this is the only proxy I am aware of that does this. It certainly seems possible that other proxy software (and not just web services) might be impacted.
