3proxy NTLM Authentication Vulnerability in 3proxy Software

CVE-2006-6982

What is CVE-2006-6982?

The 3proxy software versions 0.5 to 0.5.2 feature a significant vulnerability related to NTLM authentication, failing to enforce NTLM prior to basic authentication. This oversight allows browsers with partial RFC2616/RFC2617 compliance to default to basic cleartext authentication, which can lead to credential theft by malicious actors. Attackers may exploit this flaw to capture sensitive user credentials, thereby compromising the security of users relying on 3proxy for web proxy services.

References