Lucene search

K
freebsdFreeBSD7A921E9E-68B1-11D9-9E1E-C296AC722CB3
HistoryJan 10, 2005 - 12:00 a.m.

squid -- no sanity check of usernames in squid_ldap_auth

2005-01-1000:00:00
vuxml.freebsd.org
12

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.2%

The LDAP authentication helper did not strip
leading or trailing spaces from the login name.
According to the squid patches page:

LDAP is very forgiving about spaces in search
filters and this could be abused to log in
using several variants of the login name,
possibly bypassing explicit access controls
or confusing accounting.
Workaround: Block logins with spaces

    acl login_with_spaces proxy_auth_regex [:space:]
	    http_access deny login_with_spaces
OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchsquid< 2.5.7_7UNKNOWN

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.2%