CVE-2021-20274
📋 TL;DR
This vulnerability in Privoxy allows a crash due to a NULL-pointer dereference when the SOCKS server behaves unexpectedly. It affects Privoxy versions before 3.0.32. Systems using Privoxy as a proxy with SOCKS configuration are vulnerable to denial of service.
💻 Affected Systems
- Privoxy
📦 What is this software?
Privoxy by Privoxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Privoxy proxy, causing loss of proxy functionality for all clients.
Likely Case
Intermittent crashes of Privoxy service requiring manual restart, causing temporary proxy service disruption.
If Mitigated
No impact if SOCKS server is properly configured and behaves correctly, or if SOCKS is not used.
🎯 Exploit Status
Exploitation requires ability to interact with SOCKS server configuration or cause SOCKS server misbehavior.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.32 and later
Vendor Advisory: https://www.privoxy.org/announce.txt
Restart Required: Yes
Instructions:
1. Download Privoxy 3.0.32 or later from https://www.privoxy.org 2. Stop Privoxy service 3. Install new version 4. Restart Privoxy service
🔧 Temporary Workarounds
Disable SOCKS proxy
allRemove or comment out SOCKS configuration in Privoxy config file
# Edit /etc/privoxy/config or equivalent
# Comment out or remove 'forward-socks5' lines
Restrict SOCKS server access
linuxConfigure firewall to restrict access to SOCKS server only from trusted sources
iptables -A INPUT -p tcp --dport [SOCKS_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [SOCKS_PORT] -j DROP
🧯 If You Can't Patch
- Disable SOCKS proxy functionality in Privoxy configuration
- Implement network segmentation to isolate SOCKS server from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Privoxy version with 'privoxy --version' and verify it's below 3.0.32Check Version:
privoxy --versionVerify Fix Applied:
Verify version is 3.0.32 or higher with 'privoxy --version'📡 Detection & Monitoring
Log Indicators:
- Privoxy crash logs
- Segmentation fault errors in system logs
- Unexpected service restarts
Network Indicators:
- Sudden drop in proxy connections
- SOCKS connection failures
SIEM Query:
source="privoxy.log" AND ("segmentation fault" OR "crash" OR "SIGSEGV")