squidGuard Buffer Overflow Lets Remote Users Bypass URL Filtering
SecurityTracker Alert ID: 1023079|
SecurityTracker URL: http://securitytracker.com/id/1023079
(Links to External Site)
Date: Oct 26 2009
Denial of service via network, Host/resource access via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 1.3, 1.4|
A vulnerability was reported in squidGuard. A remote user can bypass the URL filtering mechanism. A remote user can cause denial of service conditions.|
A remote user can send a specially crafted request to trigger a buffer overflow and cause squidGuard to enter emergency mode (where no requests are filtered).
A remote user can also send a specially crafted request to cause the target service instance to freeze. This can be repeated to cause denial of service conditions.
Matthieu Bouthors reported this vulnerability.
A remote user can bypass the URL filtering mechanism.|
A remote user can cause denial of service conditions.
The vendor has issued a fix (Patch-20091015 and Patch-20091019).|
Vendor URL: squidguard.org/ (Links to External Site)
|Underlying OS: Linux (Any), UNIX (Any)|
Source Message Contents
Subject: squidGuard 1.3 & 1.4 : buffer overflow|
Found by Matthieu BOUTHORS
SquidGuard is a URL redirector used to use blacklists with the proxysoftware
Squid. There are two big advantages to squidguard: it is fast and it is free.
SquidGuard is published under GNU Public License.
Multiple buffer overflow can lead to filtering policy bypass and DoS.
The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CVE-2009-3700 to this issue. This is a candidate for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.
The vulnerability is due to insecure buffer handling.
For instance in sgLog.c :
if(vsprintf(msg, format, ap) > (MAX_BUF - 1))
This piece of code may cause a buffer overflow and detects when it's too late.
squidGuard only logs URL with patched bypass attempts (for instance, trailing
dot or double dash, see http://www.squidguard.org/Doc/advisories.html).
MAX_BUF is 4096, squid does not allow URL greater than 4096 characters.
So in order to cause a buffer overflow, the attacker has to use an URL close to
4096 characters. A succesfull attackers would put squidGuard in emergency mode,
in this mode squidGuard approve each requests. A less succesfull attacker can
freeze the squidGuard instance, reproduct this attack can lead to a DoS.
Two patches has been released by the squidGuard team : Patch-20091015 and