SecurityTracker.com Archives - (Red Hat Issues Fix for RHEL) Squid NTLM Input Validation Error in ntlm_fetch_string() Lets Remote Users Crash the System

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker
Archives

Sign Up

Instant Alerts

Buy our Premium Vulnerability Notification Service to receive customized, instant alerts

Affiliates

Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!

Partners

Become a Partner and License Our Database or Notification Service

Report a Bug

Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com

Category: Application (Generic) > Squid

Vendors: Squid-cache.org

(Red Hat Issues Fix for RHEL) Squid NTLM Input Validation Error in ntlm_fetch_string() Lets Remote Users Crash the System

SecurityTracker Alert ID: 1011473

SecurityTracker URL: http://securitytracker.com/id?1011473

CVE Reference: CAN-2004-0832 (Links to External Site)

OSVDB Reference: 9551 (Links to External Site)

Date: Sep 30 2004

Impact: Denial of service via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 2.5

Description: A vulnerability was reported in Squid in the processing of NTLM authentication strings. A remote user can cause denial of service conditions.

Marco Ortisi reported that Squid does not properly validate certain parameters to prevent negative values. If NTLM authentication is enabled, a remote user can send certain malformed NTLMSSP packets to cause the target service to crash.

The flaw resides in ntlmGetString() in 'squid/squid/helpers/ntlm_auth/fakeauth/fakeauth_auth.c' and in ntlm_fetch_string() in 'squid/squid/lib/ntlmauth.c'.

Impact: A remote user can cause the target service to crash.

Vendor URL: www.squid-cache.org/bugs/show_bug.cgi?id=1045 (Links to External Site)

Cause: Boundary error, Input validation error

Underlying OS: Linux (Red Hat Enterprise)

Reported By: bugzilla@redhat.com

Message History: This archive entry is a follow-up to the message listed below.

Sep 3 2004

Squid NTLM Input Validation Error in ntlm_fetch_string() Lets Remote Users Crash the System

Source Message Contents

Date: Thu, 30 Sep 2004 10:54 -0400
From: bugzilla@redhat.com
Subject: [RHSA-2004:462-01] Updated squid package fixes security

 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Updated squid package fixes security vulnerability
Advisory ID:       RHSA-2004:462-01
Issue date:        2004-09-30
Updated on:        2004-09-30
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2004-0832
- ---------------------------------------------------------------------

1. Summary:

An updated squid package that fixes a security vulnerability in the NTLM
authentication helper is now available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

Squid is a full-featured Web proxy cache.

An out of bounds memory read bug was found within the NTLM authentication
helper routine.  If Squid is configured to use the NTLM authentication
helper, a remote attacker could send a carefully crafted NTLM
authentication packet and cause Squid to crash.  The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0832
to this issue.

Note: The NTLM authentication helper is not enabled by default in Red Hat
Enterprise Linux 3.  Red Hat Enterprise Linux 2.1 is not vulnerable to this
issue as it shipped with a version of Squid which did not contain the
vulnerable helper. 

Users of Squid should update to this erratum package, which contains a
backported patch and is not vulnerable to this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):

131750 - CAN-2004-0832 Certain malformed NTLMSSP packets could crash the NTLM helpers provided by Squ
id

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/squid-2.5.STABLE3-6.3E.1.src.rpm
319a574d8ab2d7e1bfa454055f3f1933  squid-2.5.STABLE3-6.3E.1.src.rpm

i386:
3b46288783aacdd9842d43f221201c44  squid-2.5.STABLE3-6.3E.1.i386.rpm

ia64:
e92e66c250e34497a397c53c33ae1c2b  squid-2.5.STABLE3-6.3E.1.ia64.rpm

ppc:
726578556b36bb263526841add7dd9a2  squid-2.5.STABLE3-6.3E.1.ppc.rpm

s390:
ce1c585636cfe7843f9188f283533800  squid-2.5.STABLE3-6.3E.1.s390.rpm

s390x:
cd974ecba26d90d98a145e9813221dfb  squid-2.5.STABLE3-6.3E.1.s390x.rpm

x86_64:
0c63d4747a0e6848cd69259b6e7648dd  squid-2.5.STABLE3-6.3E.1.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/squid-2.5.STABLE3-6.3E.1.src.rpm
319a574d8ab2d7e1bfa454055f3f1933  squid-2.5.STABLE3-6.3E.1.src.rpm

i386:
3b46288783aacdd9842d43f221201c44  squid-2.5.STABLE3-6.3E.1.i386.rpm

x86_64:
0c63d4747a0e6848cd69259b6e7648dd  squid-2.5.STABLE3-6.3E.1.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/squid-2.5.STABLE3-6.3E.1.src.rpm
319a574d8ab2d7e1bfa454055f3f1933  squid-2.5.STABLE3-6.3E.1.src.rpm

i386:
3b46288783aacdd9842d43f221201c44  squid-2.5.STABLE3-6.3E.1.i386.rpm

ia64:
e92e66c250e34497a397c53c33ae1c2b  squid-2.5.STABLE3-6.3E.1.ia64.rpm

x86_64:
0c63d4747a0e6848cd69259b6e7648dd  squid-2.5.STABLE3-6.3E.1.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/squid-2.5.STABLE3-6.3E.1.src.rpm
319a574d8ab2d7e1bfa454055f3f1933  squid-2.5.STABLE3-6.3E.1.src.rpm

i386:
3b46288783aacdd9842d43f221201c44  squid-2.5.STABLE3-6.3E.1.i386.rpm

ia64:
e92e66c250e34497a397c53c33ae1c2b  squid-2.5.STABLE3-6.3E.1.ia64.rpm

x86_64:
0c63d4747a0e6848cd69259b6e7648dd  squid-2.5.STABLE3-6.3E.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key.html#package

7. References:

http://www.squid-cache.org/bugs/show_bug.cgi?id=1045
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0832

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact.html

Copyright 2004 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBXB3/XlSAg2UNWIIRAv+0AKCCo4giuS0f4+08gpTrkQf1Tq5hGACePATc
WS+U3uPqlRwelHaCy3CGGYU=
=Dg9j
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

Go to the Top of This SecurityTracker Archive Page

Home | View Topics | Search | Contact Us | Help
Copyright 2004, SecurityGlobal.net LLC