Squid May Disclose Random Internal Information to Remote Users
|
|
SecurityTracker Alert ID: 1012466
|
|
SecurityTracker URL: http://securitytracker.com/id?1012466
|
|
CVE Reference: CAN-2004-2479
(Links to External Site)
|
|
OSVDB Reference: 12282
(Links to External Site)
|
Updated: Sep 15 2005
|
Original Entry Date: Dec 9 2004
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 2.5
|
Description: A vulnerability was reported in Squid. A remote user may be able to obtain random internal information from the target server.
Artur Szostak reported that a remote user can submit a sequence of malformed hostnames to trigger failed DNS lookups to cause the
target Squid server to return random data as error messages. The random data may contain data from other requests.
A demonstration
exploit request is provided:
http://./.gz/
|
Impact: A remote user may be able to obtain random internal information from the target server.
|
Solution: A patch is available at:
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-dothost.patch
Red Hat has issued a fix for Red Hat Enterprise Linux 2.1, 3, and 4:
https://rhn.redhat.com/errata/RHSA-2005-766.html
|
Vendor URL: www.squid-cache.org/bugs/show_bug.cgi?id=1143 (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 9 Dec 2004 08:42:52 -0500
Subject: http://www.squid-cache.org/bugs/show_bug.cgi?id=1143
|
Reporter: artur [at] alice.phy.uct.ac.za (Artur Szostak)
Summary: Squid returns random error messages.
Squid returns random error messages due to reference to freed memory in
certain conditions involving a sequence of failed DNS lookups, resulting
in random messages being shown as error message in response to such host
names.
Example for squid/2.5.STABLE3
When requesting URL's of the form:
http://./.gz/
|
|
