Wingate HTTP Connect Vulnerability (SSL Tunneling)

[orestef]

Is there a way to stop clients tunneling SSL connections via "HTTP Connect" method (see http://www.securityfocus.com/bid/4131 or http://www.kb.cert.org/vuls/id/150227 for more details about this issue)? I am running Wingate 4.3. Thank you in advance.

O.

[labull]

In WWW Proxy

- Non-Proxy Requests - check Reject Request (Default)

- Https - uncheck allow any - add Port 443

Larry

[orestef]

>In WWW Proxy
>- Non-Proxy Requests - check Reject Request (Default)

Ok, i have checked it's as you suggested (Default)!

>- Https - uncheck allow any - add Port 443

Can't find any HTTPS reference in my Wingate 4.3's Gatekeeper. p.s. this installation didn't include ENS.

More suggestions needed.

O.

[labull]

Is there an Https tab under WWW Proxy?

[adrien]

i think this was a later feature

I would recommend an upgrade to a version of 5... that allows you to lock down which ports you will connect to via the CONNECT method in HTTP, which is the method that browsers use for SSL, which is why it is commonly called SSL support, or SSL tunnelling.

Adrien