Squid Analysis Report Generator Buffer Overflow in Processing HTTP User-Agent and Access Logs Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019536
|
|
SecurityTracker URL: http://securitytracker.com/id?1019536
|
|
CVE Reference: CVE-2008-1167
(Links to External Site)
|
Updated: Mar 19 2008
|
Original Entry Date: Mar 3 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 2.2.3.1 and prior versions
|
Description: A vulnerability was reported in Squid Analysis Report Generator. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can send a specially crafted HTTP User-Agent value that will trigger a buffer overflow in the report generator when
the target user processes the useragent log. Arbitrary code can be executed on the target user's system. The code will run with
the privileges of the target user.
A specially crafted 'access.log' file can also trigger the overflow.
The vendor was notified
on January 28, 2008.
L4teral reported this vulnerability.
|
Impact: A remote user can cause arbitrary code to be executed on the target user's system.
|
Solution: The vendor has issued a fix (2.2.4).
|
Vendor URL: sarg.sourceforge.net/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: L4teral <l4teral@gmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 2 Mar 2008 23:10:30 +0100
From: L4teral <l4teral@gmail.com>
Subject: Squid Analysis Report Generator <= 2.2.3.1 buffer overflow
|
======================================================================
Squid Analysis Report Generator <= 2.2.3.1 buffer overflow
======================================================================
Author: L4teral <l4teral [4t] gmail com>
Impact: buffer overflow
Status: fixed version available
------------------------------
Affected software description:
------------------------------
Application: Squid Analysis Report Generator
Version: <= 2.2.3.1
Vendor: http://sarg.sourceforge.net
Description:
Squid Analysis Report Generator is a tool that allow you to view
"where" your users are going to on the Internet.
--------------
Vulnerability:
--------------
Execution of arbitrary code is possible by executing sarg with
specially crafted squid log files (access and useragent log).
The access.log has to be manually created to trigger the exploit,
as squid will not allow malformed HTTP methods.
The useragent log is more critical, as this vulnerability can be
exploited by just passing the useragent string within a request
to the squid proxy.
------------
PoC/Exploit:
------------
Edit a normal access log and set the request method to an overly long
string.
Edit a normal useragent log and set the useragent field to an overly
long string or send a request to the Squid proxy server passing an
overly long string as useragent in the HTTP header.
---------
Solution:
---------
Upgrade to version 2.2.4 or higher.
---------
Timeline:
---------
2008-01-28 - vendor informed
2008-01-28 - vendor responded
2008-03-02 - vendor released new version
2008-03-03 - public disclosure
|
|
