https://www.exploit-db.com/exploits/26198
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200508-305

AstaroSecurityLinux6.0中的HTTP代理不能正确地过滤向localhost的HTTPCONNECT请求。这使得远程攻击者可以绕过防火墙规则而连接本地服务。

source: http://www.securityfocus.com/bid/14665/info

Astaro Security Linux is prone to a weakness that may allow remote attackers to connect to arbitrary ports on a vulnerable computer.

This weakness may be combined with other attacks to exploit latent vulnerabilities. An attacker can bypass access controls implemented by the application through this attack.

Astaro Security Linux 6.001 is prone to this weakness. 

Connect to TCP port 8080 and enter the following command:

CONNECT localhost:80 HTTP/1.0

来源:BUGTRAQ
名称:20050825AstaroSecurityLinux6.0-HTTPCONNECTAccessLocalhostWeakness
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112501186602731&w;=2
来源:XF
名称:astaro-http-proxy-tcp-connect(22021)
链接:http://xforce.iss.net/xforce/xfdb/22021
来源:BID
名称:14665
链接:http://www.securityfocus.com/bid/14665
来源:SECUNIA
名称:16578
链接:http://secunia.com/advisories/16578/