FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)
2005-07-13T00:00:00
ID FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL Type nessus Reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2019-11-02T00:00:00
Description
The squid patches page notes :
This patch makes Squid considerably stricter while parsing the HTTP
protocol.
A Content-length header should only appear once in a valid request
or response. Multiple Content-length headers, in conjunction with
specially crafted requests, may allow Squid
#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
# copyright notice, this list of conditions and the following
# disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
# published online in any format, converted to PDF, PostScript,
# RTF and other formats) must reproduce the above copyright
# notice, this list of conditions and the following disclaimer
# in the documentation and/or other materials provided with the
# distribution.
#
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
include("compat.inc");
if (description)
{
script_id(19089);
script_version("1.15");
script_cvs_date("Date: 2019/08/02 13:32:37");
script_cve_id("CVE-2005-0174");
script_xref(name:"CERT", value:"768702");
script_name(english:"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)");
script_summary(english:"Checks for updated package in pkg_info output");
script_set_attribute(
attribute:"synopsis",
value:"The remote FreeBSD host is missing a security-related update."
);
script_set_attribute(
attribute:"description",
value:
"The squid patches page notes :
This patch makes Squid considerably stricter while parsing the HTTP
protocol.
- A Content-length header should only appear once in a valid request
or response. Multiple Content-length headers, in conjunction with
specially crafted requests, may allow Squid's cache to be poisoned
with bad content in certain situations.
- CR characters is only allowed as part of the CR NL line terminator,
not alone. This to ensure that all involved agrees on the structure of
HTTP headers.
- Rejects requests/responses that have whitespace in an HTTP header
name.
To enable these strict parsing rules, update to at least squid-2.5.7_9
and specify relaxed_header_parser off in squid.conf."
);
# http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?f705228c"
);
# https://vuxml.freebsd.org/freebsd/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?4e09cd67"
);
script_set_attribute(attribute:"solution", value:"Update the affected package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:squid");
script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/24");
script_set_attribute(attribute:"patch_publication_date", value:"2005/01/24");
script_set_attribute(attribute:"plugin_publication_date", value:"2005/07/13");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"FreeBSD Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
exit(0);
}
include("audit.inc");
include("freebsd_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if (pkg_test(save_report:TRUE, pkg:"squid<2.5.7_9")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
else security_warning(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
{"id": "FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL", "bulletinFamily": "scanner", "title": "FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)", "description": "The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid", "published": "2005-07-13T00:00:00", "modified": "2019-11-02T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "href": "https://www.tenable.com/plugins/nessus/19089", "reporter": "This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://www.nessus.org/u?4e09cd67", "http://www.nessus.org/u?f705228c"], "cvelist": ["CVE-2005-0174"], "type": "nessus", "lastseen": "2019-11-01T02:39:25", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:freebsd:freebsd:squid", "cpe:/o:freebsd:freebsd"], "cvelist": ["CVE-2005-0174"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "description": "The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid", "edition": 8, "enchantments": {"dependencies": {"modified": "2019-10-28T20:23:03", "references": [{"idList": ["UBUNTU_USN-77-1.NASL", "GENTOO_GLSA-200502-04.NASL", "DEBIAN_DSA-667.NASL", "MANDRAKE_MDKSA-2005-034.NASL", "SUSE_SA_2005_006.NASL", "REDHAT-RHSA-2005-061.NASL", "SQUID_WCCP_AND_GOPHER_FLAWS.NASL", "FEDORA_2005-373.NASL", "REDHAT-RHSA-2005-060.NASL"], "type": "nessus"}, {"idList": ["OPENVAS:52208", "OPENVAS:54836"], "type": "openvas"}, {"idList": ["B4D94FA0-6E38-11D9-9E1E-C296AC722CB3"], "type": "freebsd"}, {"idList": ["SUSE-SA:2005:006"], "type": "suse"}, {"idList": ["OSVDB:13732"], "type": "osvdb"}, {"idList": ["RHSA-2005:060", "RHSA-2005:061"], "type": "redhat"}, {"idList": ["GLSA-200502-04"], "type": "gentoo"}, {"idList": ["CVE-2005-0174"], "type": "cve"}, {"idList": ["USN-77-1"], "type": "ubuntu"}]}, "score": {"modified": "2019-10-28T20:23:03", "value": 5.8, "vector": "NONE"}}, "hash": "42018f98fcb4018796f8abb617ecf5fd3c3a0fe4179568a836e494c01799bf07", "hashmap": [{"hash": "fe45aa727b58c1249bf04cfb7b4e6ae0", "key": "naslFamily"}, {"hash": "b5bbdd851ff7634dd01c09e00d03be1e", "key": "cvss"}, {"hash": "5e15cda1e04408ef9f171f4640b7f818", "key": "references"}, {"hash": "d705e32653488266f9010eda9271ecc3", "key": "reporter"}, {"hash": "9024ab754ee339f101e22cbcc0c75129", "key": "published"}, {"hash": "bb7f78252b426a28455be8c682f320ee", "key": "cvelist"}, {"hash": "bbe74f117a9164f5d95ea4e941f9bb8e", "key": "title"}, {"hash": "21c501239baa1935b0ac1b7379e66f35", "key": "description"}, {"hash": "8c22fb7b15dadb47a51d86aa5e04b6aa", "key": "sourceData"}, {"hash": "cf9bc13940118ba0d4b4e85f5c3d4c87", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "0bafb6325bcaf483a25404f785191cc5", "key": "modified"}, {"hash": "87dcb87be69fb91cb49c72dcab1b9f9d", "key": "cpe"}, {"hash": "5294ae708c664025c29d19828d4f0116", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/19089", "id": "FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL", "lastseen": "2019-10-28T20:23:03", "modified": "2019-10-02T00:00:00", "naslFamily": "FreeBSD Local Security Checks", "objectVersion": "1.3", "pluginID": "19089", "published": "2005-07-13T00:00:00", "references": ["http://www.nessus.org/u?4e09cd67", "http://www.nessus.org/u?f705228c"], "reporter": "This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19089);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2019/08/02 13:32:37\");\n\n script_cve_id(\"CVE-2005-0174\");\n script_xref(name:\"CERT\", value:\"768702\");\n\n script_name(english:\"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f705228c\"\n );\n # https://vuxml.freebsd.org/freebsd/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4e09cd67\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"squid<2.5.7_9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)", "type": "nessus", "viewCount": 1}, "differentElements": ["modified"], "edition": 8, "lastseen": "2019-10-28T20:23:03"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:freebsd:freebsd:squid", "cpe:/o:freebsd:freebsd"], "cvelist": ["CVE-2005-0174"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.", "edition": 6, "enchantments": {"dependencies": {"modified": "2019-01-16T20:06:13", "references": [{"idList": ["UBUNTU_USN-77-1.NASL", "GENTOO_GLSA-200502-04.NASL", "DEBIAN_DSA-667.NASL", "MANDRAKE_MDKSA-2005-034.NASL", "SUSE_SA_2005_006.NASL", "REDHAT-RHSA-2005-061.NASL", "SQUID_WCCP_AND_GOPHER_FLAWS.NASL", "FEDORA_2005-373.NASL", "REDHAT-RHSA-2005-060.NASL"], "type": "nessus"}, {"idList": ["OPENVAS:52208", "OPENVAS:54836"], "type": "openvas"}, {"idList": ["B4D94FA0-6E38-11D9-9E1E-C296AC722CB3"], "type": "freebsd"}, {"idList": ["SUSE-SA:2005:006"], "type": "suse"}, {"idList": ["OSVDB:13732"], "type": "osvdb"}, {"idList": ["RHSA-2005:060", "RHSA-2005:061"], "type": "redhat"}, {"idList": ["GLSA-200502-04"], "type": "gentoo"}, {"idList": ["CVE-2005-0174"], "type": "cve"}, {"idList": ["USN-77-1"], "type": "ubuntu"}]}, "score": {"value": 5.0, "vector": "NONE"}}, "hash": "f7752a9b41a3230ddd46b5d56d3f36e29b961910cafd99e9643514055221a337", "hashmap": [{"hash": "fe45aa727b58c1249bf04cfb7b4e6ae0", "key": "naslFamily"}, {"hash": "5e15cda1e04408ef9f171f4640b7f818", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "0f3102a4cbd06656620e15dd3d95020f", "key": "href"}, {"hash": "9024ab754ee339f101e22cbcc0c75129", "key": "published"}, {"hash": "bb7f78252b426a28455be8c682f320ee", "key": "cvelist"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "bbe74f117a9164f5d95ea4e941f9bb8e", "key": "title"}, {"hash": "cf9bc13940118ba0d4b4e85f5c3d4c87", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3c764d4cf584f9ded7aa4dcca57c78ff", "key": "modified"}, {"hash": "87dcb87be69fb91cb49c72dcab1b9f9d", "key": "cpe"}, {"hash": "e80115eb3085ead7c0c60b20338d18ef", "key": "sourceData"}, {"hash": "1545b15c16d9a689bffef35a532340ce", "key": "description"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=19089", "id": "FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL", "lastseen": "2019-01-16T20:06:13", "modified": "2018-11-10T00:00:00", "naslFamily": "FreeBSD Local Security Checks", "objectVersion": "1.3", "pluginID": "19089", "published": "2005-07-13T00:00:00", "references": ["http://www.nessus.org/u?4e09cd67", "http://www.nessus.org/u?f705228c"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19089);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/11/10 11:49:40\");\n\n script_cve_id(\"CVE-2005-0174\");\n script_xref(name:\"CERT\", value:\"768702\");\n\n script_name(english:\"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f705228c\"\n );\n # https://vuxml.freebsd.org/freebsd/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4e09cd67\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"squid<2.5.7_9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)", "type": "nessus", "viewCount": 1}, "differentElements": ["description"], "edition": 6, "lastseen": "2019-01-16T20:06:13"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:freebsd:freebsd:squid", "cpe:/o:freebsd:freebsd"], "cvelist": ["CVE-2005-0174"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP protocol.\n\n- A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache to be poisoned with bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator, not alone. This to ensure that all involved agrees on the structure of HTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header name.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9 and specify relaxed_header_parser off in squid.conf.", "edition": 2, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "029c8a4c5ed58bc811c2825ad269bf27a9d7758a6677277597d9acf4b71c306e", "hashmap": [{"hash": "fe45aa727b58c1249bf04cfb7b4e6ae0", "key": "naslFamily"}, {"hash": "b540797a005019f00f860d4babc60dab", "key": "modified"}, {"hash": "d5705b7d0dd7aa23fd5540f666f8cd5a", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "0f3102a4cbd06656620e15dd3d95020f", "key": "href"}, {"hash": "5cc8e795e35cd61e51c144b1f2d8a120", "key": "description"}, {"hash": "9024ab754ee339f101e22cbcc0c75129", "key": "published"}, {"hash": "bb7f78252b426a28455be8c682f320ee", "key": "cvelist"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "bbe74f117a9164f5d95ea4e941f9bb8e", "key": "title"}, {"hash": "cf9bc13940118ba0d4b4e85f5c3d4c87", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "19f801a749e7dbee2e710ebd188e3763", "key": "sourceData"}, {"hash": "87dcb87be69fb91cb49c72dcab1b9f9d", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=19089", "id": "FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL", "lastseen": "2017-10-29T13:33:41", "modified": "2013-06-22T00:00:00", "naslFamily": "FreeBSD Local Security Checks", "objectVersion": "1.3", "pluginID": "19089", "published": "2005-07-13T00:00:00", "references": ["http://www.nessus.org/u?fdd845bf", "http://www.nessus.org/u?f705228c"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2013 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19089);\n script_version(\"$Revision: 1.13 $\");\n script_cvs_date(\"$Date: 2013/06/22 00:06:26 $\");\n\n script_cve_id(\"CVE-2005-0174\");\n script_xref(name:\"CERT\", value:\"768702\");\n\n script_name(english:\"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f705228c\"\n );\n # http://www.freebsd.org/ports/portaudit/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fdd845bf\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2013 Tenable Network Security, Inc.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"squid<2.5.7_9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)", "type": "nessus", "viewCount": 1}, "differentElements": ["cvss"], "edition": 2, "lastseen": "2017-10-29T13:33:41"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:freebsd:freebsd:squid", "cpe:/o:freebsd:freebsd"], "cvelist": ["CVE-2005-0174"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP protocol.\n\n- A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache to be poisoned with bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator, not alone. This to ensure that all involved agrees on the structure of HTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header name.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9 and specify relaxed_header_parser off in squid.conf.", "edition": 4, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "029c8a4c5ed58bc811c2825ad269bf27a9d7758a6677277597d9acf4b71c306e", "hashmap": [{"hash": "fe45aa727b58c1249bf04cfb7b4e6ae0", "key": "naslFamily"}, {"hash": "b540797a005019f00f860d4babc60dab", "key": "modified"}, {"hash": "d5705b7d0dd7aa23fd5540f666f8cd5a", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "0f3102a4cbd06656620e15dd3d95020f", "key": "href"}, {"hash": "5cc8e795e35cd61e51c144b1f2d8a120", "key": "description"}, {"hash": "9024ab754ee339f101e22cbcc0c75129", "key": "published"}, {"hash": "bb7f78252b426a28455be8c682f320ee", "key": "cvelist"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "bbe74f117a9164f5d95ea4e941f9bb8e", "key": "title"}, {"hash": "cf9bc13940118ba0d4b4e85f5c3d4c87", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "19f801a749e7dbee2e710ebd188e3763", "key": "sourceData"}, {"hash": "87dcb87be69fb91cb49c72dcab1b9f9d", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=19089", "id": "FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL", "lastseen": "2018-09-01T23:34:00", "modified": "2013-06-22T00:00:00", "naslFamily": "FreeBSD Local Security Checks", "objectVersion": "1.3", "pluginID": "19089", "published": "2005-07-13T00:00:00", "references": ["http://www.nessus.org/u?fdd845bf", "http://www.nessus.org/u?f705228c"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2013 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19089);\n script_version(\"$Revision: 1.13 $\");\n script_cvs_date(\"$Date: 2013/06/22 00:06:26 $\");\n\n script_cve_id(\"CVE-2005-0174\");\n script_xref(name:\"CERT\", value:\"768702\");\n\n script_name(english:\"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f705228c\"\n );\n # http://www.freebsd.org/ports/portaudit/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fdd845bf\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2013 Tenable Network Security, Inc.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"squid<2.5.7_9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)", "type": "nessus", "viewCount": 1}, "differentElements": ["references", "modified", "sourceData"], "edition": 4, "lastseen": "2018-09-01T23:34:00"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2005-0174"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "description": "The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP protocol.\n\n- A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache to be poisoned with bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator, not alone. This to ensure that all involved agrees on the structure of HTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header name.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9 and specify relaxed_header_parser off in squid.conf.", "edition": 1, "enchantments": {}, "hash": "8611b126aa24a2f9cdfa7f7277d521d38ca889bb7c0fed3b15229d54bb45869b", "hashmap": [{"hash": "fe45aa727b58c1249bf04cfb7b4e6ae0", "key": "naslFamily"}, {"hash": "b540797a005019f00f860d4babc60dab", "key": "modified"}, {"hash": "d5705b7d0dd7aa23fd5540f666f8cd5a", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "0f3102a4cbd06656620e15dd3d95020f", "key": "href"}, {"hash": "5cc8e795e35cd61e51c144b1f2d8a120", "key": "description"}, {"hash": "9024ab754ee339f101e22cbcc0c75129", "key": "published"}, {"hash": "bb7f78252b426a28455be8c682f320ee", "key": "cvelist"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "bbe74f117a9164f5d95ea4e941f9bb8e", "key": "title"}, {"hash": "cf9bc13940118ba0d4b4e85f5c3d4c87", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "19f801a749e7dbee2e710ebd188e3763", "key": "sourceData"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=19089", "id": "FREEBSD_PKG_B4D94FA06E3811D99E1EC296AC722CB3.NASL", "lastseen": "2016-09-26T17:23:17", "modified": "2013-06-22T00:00:00", "naslFamily": "FreeBSD Local Security Checks", "objectVersion": "1.2", "pluginID": "19089", "published": "2005-07-13T00:00:00", "references": ["http://www.nessus.org/u?fdd845bf", "http://www.nessus.org/u?f705228c"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2013 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19089);\n script_version(\"$Revision: 1.13 $\");\n script_cvs_date(\"$Date: 2013/06/22 00:06:26 $\");\n\n script_cve_id(\"CVE-2005-0174\");\n script_xref(name:\"CERT\", value:\"768702\");\n\n script_name(english:\"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f705228c\"\n );\n # http://www.freebsd.org/ports/portaudit/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fdd845bf\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2013 Tenable Network Security, Inc.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"squid<2.5.7_9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)", "type": "nessus", "viewCount": 0}, "differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:23:17"}], "edition": 9, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "87dcb87be69fb91cb49c72dcab1b9f9d"}, {"key": "cvelist", "hash": "bb7f78252b426a28455be8c682f320ee"}, {"key": "cvss", "hash": "b5bbdd851ff7634dd01c09e00d03be1e"}, {"key": "description", "hash": "21c501239baa1935b0ac1b7379e66f35"}, {"key": "href", "hash": "5294ae708c664025c29d19828d4f0116"}, {"key": "modified", "hash": "abcf9266f425f12dda38f529cd4a94bc"}, {"key": "naslFamily", "hash": "fe45aa727b58c1249bf04cfb7b4e6ae0"}, {"key": "pluginID", "hash": "cf9bc13940118ba0d4b4e85f5c3d4c87"}, {"key": "published", "hash": "9024ab754ee339f101e22cbcc0c75129"}, {"key": "references", "hash": "5e15cda1e04408ef9f171f4640b7f818"}, {"key": "reporter", "hash": "d705e32653488266f9010eda9271ecc3"}, {"key": "sourceData", "hash": "8c22fb7b15dadb47a51d86aa5e04b6aa"}, {"key": "title", "hash": "bbe74f117a9164f5d95ea4e941f9bb8e"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "d0d7394f5d9a21352530b02203d02c5c3cd72c290e085b9028518afbefc49026", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2005-0174"]}, {"type": "osvdb", "idList": ["OSVDB:13732"]}, {"type": "freebsd", "idList": ["B4D94FA0-6E38-11D9-9E1E-C296AC722CB3"]}, {"type": "openvas", "idList": ["OPENVAS:52208", "OPENVAS:54836"]}, {"type": "ubuntu", "idList": ["USN-77-1"]}, {"type": "nessus", "idList": ["MANDRAKE_MDKSA-2005-034.NASL", "UBUNTU_USN-77-1.NASL", "DEBIAN_DSA-667.NASL", "GENTOO_GLSA-200502-04.NASL", "FEDORA_2005-373.NASL", "REDHAT-RHSA-2005-061.NASL", "REDHAT-RHSA-2005-060.NASL", "SQUID_WCCP_AND_GOPHER_FLAWS.NASL", "SUSE_SA_2005_006.NASL"]}, {"type": "gentoo", "idList": ["GLSA-200502-04"]}, {"type": "redhat", "idList": ["RHSA-2005:060", "RHSA-2005:061"]}, {"type": "suse", "idList": ["SUSE-SA:2005:006"]}], "modified": "2019-11-01T02:39:25"}, "score": {"value": 5.8, "vector": "NONE", "modified": "2019-11-01T02:39:25"}, "vulnersScore": 5.8}, "objectVersion": "1.3", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19089);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2019/08/02 13:32:37\");\n\n script_cve_id(\"CVE-2005-0174\");\n script_xref(name:\"CERT\", value:\"768702\");\n\n script_name(english:\"FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The squid patches page notes :\n\nThis patch makes Squid considerably stricter while parsing the HTTP\nprotocol.\n\n- A Content-length header should only appear once in a valid request\nor response. Multiple Content-length headers, in conjunction with\nspecially crafted requests, may allow Squid's cache to be poisoned\nwith bad content in certain situations.\n\n- CR characters is only allowed as part of the CR NL line terminator,\nnot alone. This to ensure that all involved agrees on the structure of\nHTTP headers.\n\n- Rejects requests/responses that have whitespace in an HTTP header\nname.\n\nTo enable these strict parsing rules, update to at least squid-2.5.7_9\nand specify relaxed_header_parser off in squid.conf.\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f705228c\"\n );\n # https://vuxml.freebsd.org/freebsd/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4e09cd67\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"squid<2.5.7_9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "FreeBSD Local Security Checks", "pluginID": "19089", "cpe": ["p-cpe:/a:freebsd:freebsd:squid", "cpe:/o:freebsd:freebsd"], "scheme": null}
{"cve": [{"lastseen": "2019-05-29T18:08:13", "bulletinFamily": "NVD", "description": "Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.", "modified": "2017-10-11T01:29:00", "id": "CVE-2005-0174", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0174", "published": "2005-02-07T05:00:00", "title": "CVE-2005-0174", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "openvas": [{"lastseen": "2017-07-02T21:10:22", "bulletinFamily": "scanner", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-30T00:00:00", "published": "2008-09-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=52208", "id": "OPENVAS:52208", "title": "FreeBSD Ports: squid", "type": "openvas", "sourceData": "#\n#VID b4d94fa0-6e38-11d9-9e1e-c296ac722cb3\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: squid\n\nCVE-2005-0174\nSquid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the\ncache or conduct certain attacks via headers that do not follow the\nHTTP specification, including (1) multiple Content-Length headers, (2)\ncarriage return (CR) characters that are not part of a CRLF pair, and\n(3) header names containing whitespace characters.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing\nhttp://www.vuxml.org/freebsd/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52208);\n script_version(\"$Revision: 4188 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-30 07:56:47 +0200 (Fri, 30 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_bugtraq_id(12412);\n script_cve_id(\"CVE-2005-0174\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_name(\"FreeBSD Ports: squid\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"squid\");\nif(!isnull(bver) && revcomp(a:bver, b:\"2.5.7_9\")<0) {\n txt += 'Package squid version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-07-24T12:49:54", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200502-04.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=54836", "id": "OPENVAS:54836", "title": "Gentoo Security Advisory GLSA 200502-04 (squid)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Squid contains vulnerabilities in the code handling WCCP, HTTP and LDAP\nwhich could lead to Denial of Service, access control bypass, web cache\nand log poisoning.\";\ntag_solution = \"All Squid users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-proxy/squid-2.5.7-r5'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200502-04\nhttp://bugs.gentoo.org/show_bug.cgi?id=79495\nhttp://bugs.gentoo.org/show_bug.cgi?id=78776\nhttp://bugs.gentoo.org/show_bug.cgi?id=80201\nhttp://bugs.gentoo.org/show_bug.cgi?id=80341\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200502-04.\";\n\n \n\nif(description)\n{\n script_id(54836);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_cve_id(\"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Gentoo Security Advisory GLSA 200502-04 (squid)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"www-proxy/squid\", unaffected: make_list(\"ge 2.5.7-r5\"), vulnerable: make_list(\"lt 2.5.7-r5\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:09", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nVendor URL: http://www.squid-cache.org/\n[Vendor Specific Advisory URL](http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing)\n[Vendor Specific Advisory URL](http://www.debian.org/security/2005/dsa-667)\n[Vendor Specific Advisory URL](http://www.gentoo.org/security/en/glsa/glsa-200502-04.xml)\n[Secunia Advisory ID:14228](https://secuniaresearch.flexerasoftware.com/advisories/14228/)\n[Secunia Advisory ID:14484](https://secuniaresearch.flexerasoftware.com/advisories/14484/)\n[Secunia Advisory ID:15093](https://secuniaresearch.flexerasoftware.com/advisories/15093/)\n[Secunia Advisory ID:14251](https://secuniaresearch.flexerasoftware.com/advisories/14251/)\n[Secunia Advisory ID:14185](https://secuniaresearch.flexerasoftware.com/advisories/14185/)\nRedHat RHSA: RHSA-2005:061\nOther Advisory URL: http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:034\nOther Advisory URL: http://www.astaro.org/showflat.php?Cat=&Number=56136&page=0&view=collapsed&sb=5&o=&fpart=1#56136\nOther Advisory URL: http://www.ubuntulinux.org/support/documentation/usn/usn-77-1\nOther Advisory URL: http://www.sourcefire.com/services/advisories/sa062905.html\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=110780531820947&w=2\n[CVE-2005-0174](https://vulners.com/cve/CVE-2005-0174)\nCERT VU: 768702\n", "modified": "2005-01-27T00:00:00", "published": "2005-01-27T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:13732", "id": "OSVDB:13732", "title": "Squid Multiple Method Invalid Header Cache Poisoning", "type": "osvdb", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "freebsd": [{"lastseen": "2019-05-29T18:35:04", "bulletinFamily": "unix", "description": "\nThe squid patches page notes:\n\nThis patch makes Squid considerably stricter while\n\t parsing the HTTP protocol.\n\nA Content-length header should only appear once in a\n\t valid request or response. Multiple Content-length\n\t headers, in conjunction with specially crafted requests,\n\t may allow Squid's cache to be poisoned with bad content\n\t in certain situations.\nCR characters is only allowed as part of the CR NL\n\t line terminator, not alone. This to ensure that all\n\t involved agrees on the structure of HTTP headers.\nRejects requests/responses that have whitespace in an\n\t HTTP header name.\n\n\nTo enable these strict parsing rules, update to at least\n\t squid-2.5.7_9 and specify relaxed_header_parser\n\t off in squid.conf.\n", "modified": "2006-01-02T00:00:00", "published": "2005-01-24T00:00:00", "id": "B4D94FA0-6E38-11D9-9E1E-C296AC722CB3", "href": "https://vuxml.freebsd.org/freebsd/b4d94fa0-6e38-11d9-9e1e-c296ac722cb3.html", "title": "squid -- possible cache-poisoning via malformed HTTP responses", "type": "freebsd", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "ubuntu": [{"lastseen": "2019-05-29T17:21:58", "bulletinFamily": "unix", "description": "A possible authentication bypass was discovered in the LDAP authentication backend. LDAP ignores leading and trailing whitespace in search filters. This could possibly be abused to bypass explicit access controls or confuse accounting when using several variants of the login name. (CAN-2005-0173)\n\nPrevious Squid versions were not strict enough while parsing HTTP requests and responses. Various violations of the HTTP protocol, such as multiple Content-Length header lines, invalid \u201cCarriage Return\u201d characters, and HTTP header names containing whitespace, led to cache pollution and could possibly be exploited to deliver wrong content to clients. (CAN-2005-0174)\n\nSquid was susceptible to a cache poisoning attack called \u201cHTTP response splitting\u201d, where false replies are injected in the HTTP stream. This allowed malicious web servers to forge wrong cache content for arbitrary web sites, which was then delivered to Squid clients. (CAN-2005-0175)\n\nThe FSC Vulnerability Research Team discovered a buffer overflow in the WCCP handling protocol. By sending an overly large WCCP packet, a remote attacker could crash the Squid server, and possibly even execute arbitrary code with the privileges of the \u201cproxy\u201d user. (CAN-2005-0211)", "modified": "2005-02-08T00:00:00", "published": "2005-02-08T00:00:00", "id": "USN-77-1", "href": "https://usn.ubuntu.com/77-1/", "title": "Squid vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2019-11-01T02:54:57", "bulletinFamily": "scanner", "description": "More vulnerabilities were discovered in the squid server :\n\nThe LDAP handling of search filters was inadequate which could be\nabused to allow logins using severial variants of a single login name,\npossibly bypassing explicit access controls (CVE-2005-0173).\n\nMinor problems in the HTTP header parsing code that could be used for\ncache poisoning (CVE-2005-0174 and CVE-2005-0175).\n\nA buffer overflow in the WCCP handling code allowed remote attackers\nto cause a Denial of Service and could potentially allow for the\nexecution of arbitrary code by using a long WCCP packet.\n\nThe updated packages have been patched to prevent these problems.", "modified": "2019-11-02T00:00:00", "id": "MANDRAKE_MDKSA-2005-034.NASL", "href": "https://www.tenable.com/plugins/nessus/16377", "published": "2005-02-11T00:00:00", "title": "Mandrake Linux Security Advisory : squid (MDKSA-2005:034)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2005:034. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16377);\n script_version (\"1.17\");\n script_cvs_date(\"Date: 2019/08/02 13:32:47\");\n\n script_cve_id(\"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\");\n script_xref(name:\"MDKSA\", value:\"2005:034\");\n\n script_name(english:\"Mandrake Linux Security Advisory : squid (MDKSA-2005:034)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandrake Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"More vulnerabilities were discovered in the squid server :\n\nThe LDAP handling of search filters was inadequate which could be\nabused to allow logins using severial variants of a single login name,\npossibly bypassing explicit access controls (CVE-2005-0173).\n\nMinor problems in the HTTP header parsing code that could be used for\ncache poisoning (CVE-2005-0174 and CVE-2005-0175).\n\nA buffer overflow in the WCCP handling code allowed remote attackers\nto cause a Denial of Service and could potentially allow for the\nexecution of arbitrary code by using a long WCCP packet.\n\nThe updated packages have been patched to prevent these problems.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_3.txt\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected squid package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:10.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:9.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK10.0\", reference:\"squid-2.5.STABLE4-2.4.100mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK10.1\", reference:\"squid-2.5.STABLE6-2.3.101mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK9.2\", reference:\"squid-2.5.STABLE3-3.6.92mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T02:40:13", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200502-04\n(Squid: Multiple vulnerabilities)\n\n Squid contains several vulnerabilities:\n Buffer overflow when handling WCCP recvfrom()\n (CAN-2005-0211).\n Loose checking of HTTP headers (CAN-2005-0173 and\n CAN-2005-0174).\n Incorrect handling of LDAP login names with spaces\n (CAN-2005-0175).\n \nImpact :\n\n An attacker could exploit:\n the WCCP buffer overflow to cause Denial of Service.\n the HTTP header parsing vulnerabilities to inject arbitrary\n response data, potentially leading to content spoofing, web cache\n poisoning and other cross-site scripting or HTTP response splitting\n attacks.\n the LDAP issue to login with several variations of the same login\n name, leading to log poisoning.\n \nWorkaround :\n\n There is no known workaround at this time.", "modified": "2019-11-02T00:00:00", "id": "GENTOO_GLSA-200502-04.NASL", "href": "https://www.tenable.com/plugins/nessus/16441", "published": "2005-02-14T00:00:00", "title": "GLSA-200502-04 : Squid: Multiple vulnerabilities", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200502-04.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16441);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2019/08/02 13:32:42\");\n\n script_cve_id(\"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\");\n script_xref(name:\"GLSA\", value:\"200502-04\");\n\n script_name(english:\"GLSA-200502-04 : Squid: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200502-04\n(Squid: Multiple vulnerabilities)\n\n Squid contains several vulnerabilities:\n Buffer overflow when handling WCCP recvfrom()\n (CAN-2005-0211).\n Loose checking of HTTP headers (CAN-2005-0173 and\n CAN-2005-0174).\n Incorrect handling of LDAP login names with spaces\n (CAN-2005-0175).\n \nImpact :\n\n An attacker could exploit:\n the WCCP buffer overflow to cause Denial of Service.\n the HTTP header parsing vulnerabilities to inject arbitrary\n response data, potentially leading to content spoofing, web cache\n poisoning and other cross-site scripting or HTTP response splitting\n attacks.\n the LDAP issue to login with several variations of the same login\n name, leading to log poisoning.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200502-04\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Squid users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-proxy/squid-2.5.7-r5'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/14\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-proxy/squid\", unaffected:make_list(\"ge 2.5.7-r5\"), vulnerable:make_list(\"lt 2.5.7-r5\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Squid\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T02:25:48", "bulletinFamily": "scanner", "description": "Several vulnerabilities have been discovered in Squid, the internet\nobject cache, the popular WWW proxy cache. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities :\n\n - CAN-2005-0173\n LDAP is very forgiving about spaces in search filters\n and this could be abused to log in using several\n variants of the login name, possibly bypassing explicit\n access controls or confusing accounting.\n\n - CAN-2005-0175\n\n Cache pollution/poisoning via HTTP response splitting\n has been discovered.\n\n - CAN-2005-0194\n\n The meaning of the access controls becomes somewhat\n confusing if any of the referenced ACLs (access control\n lists) is declared empty, without any members.\n\n - CAN-2005-0211\n\n The length argument of the WCCP recvfrom() call is\n larger than it should be. An attacker may send a larger\n than normal WCCP packet that could overflow a buffer.", "modified": "2019-11-02T00:00:00", "id": "DEBIAN_DSA-667.NASL", "href": "https://www.tenable.com/plugins/nessus/16341", "published": "2005-02-10T00:00:00", "title": "Debian DSA-667-1 : squid - several vulnerabilities", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-667. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16341);\n script_version(\"1.21\");\n script_cvs_date(\"Date: 2019/08/02 13:32:18\");\n\n script_cve_id(\"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0194\", \"CVE-2005-0211\");\n script_xref(name:\"CERT\", value:\"625878\");\n script_xref(name:\"CERT\", value:\"886006\");\n script_xref(name:\"CERT\", value:\"924198\");\n script_xref(name:\"DSA\", value:\"667\");\n\n script_name(english:\"Debian DSA-667-1 : squid - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in Squid, the internet\nobject cache, the popular WWW proxy cache. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities :\n\n - CAN-2005-0173\n LDAP is very forgiving about spaces in search filters\n and this could be abused to log in using several\n variants of the login name, possibly bypassing explicit\n access controls or confusing accounting.\n\n - CAN-2005-0175\n\n Cache pollution/poisoning via HTTP response splitting\n has been discovered.\n\n - CAN-2005-0194\n\n The meaning of the access controls becomes somewhat\n confusing if any of the referenced ACLs (access control\n lists) is declared empty, without any members.\n\n - CAN-2005-0211\n\n The length argument of the WCCP recvfrom() call is\n larger than it should be. An attacker may send a larger\n than normal WCCP packet that could overflow a buffer.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2005/dsa-667\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the squid package.\n\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.6-2woody6.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:3.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/10\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2004/12/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"3.0\", prefix:\"squid\", reference:\"2.4.6-2woody6\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"squid-cgi\", reference:\"2.4.6-2woody6\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"squidclient\", reference:\"2.4.6-2woody6\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-11-03T12:38:18", "bulletinFamily": "scanner", "description": "A possible authentication bypass was discovered in the LDAP\nauthentication backend. LDAP ignores leading and trailing whitespace\nin search filters. This could possibly be abused to bypass explicit\naccess controls or confuse accounting when using several variants of\nthe login name. (CAN-2005-0173)\n\nPrevious Squid versions were not strict enough while parsing HTTP\nrequests and responses. Various violations of the HTTP protocol, such\nas multiple Content-Length header lines, invalid ", "modified": "2019-11-02T00:00:00", "id": "UBUNTU_USN-77-1.NASL", "href": "https://www.tenable.com/plugins/nessus/20699", "published": "2006-01-15T00:00:00", "title": "Ubuntu 4.10 : squid vulnerabilities (USN-77-1)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-77-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(20699);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2019/08/02 13:33:00\");\n\n script_cve_id(\"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\");\n script_xref(name:\"USN\", value:\"77-1\");\n\n script_name(english:\"Ubuntu 4.10 : squid vulnerabilities (USN-77-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A possible authentication bypass was discovered in the LDAP\nauthentication backend. LDAP ignores leading and trailing whitespace\nin search filters. This could possibly be abused to bypass explicit\naccess controls or confuse accounting when using several variants of\nthe login name. (CAN-2005-0173)\n\nPrevious Squid versions were not strict enough while parsing HTTP\nrequests and responses. Various violations of the HTTP protocol, such\nas multiple Content-Length header lines, invalid 'Carriage Return'\ncharacters, and HTTP header names containing whitespace, led to cache\npollution and could possibly be exploited to deliver wrong content to\nclients. (CAN-2005-0174)\n\nSquid was susceptible to a cache poisoning attack called 'HTTP\nresponse splitting', where false replies are injected in the HTTP\nstream. This allowed malicious web servers to forge wrong cache\ncontent for arbitrary websites, which was then delivered to Squid\nclients. (CAN-2005-0175)\n\nThe FSC Vulnerability Research Team discovered a buffer overflow in\nthe WCCP handling protocol. By sending an overly large WCCP packet, a\nremote attacker could crash the Squid server, and possibly even\nexecute arbitrary code with the privileges of the 'proxy' user.\n(CAN-2005-0211).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid-cgi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squid-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:squidclient\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:4.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/01/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(4\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 4.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"4.10\", pkgname:\"squid\", pkgver:\"2.5.5-6ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"squid-cgi\", pkgver:\"2.5.5-6ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"squid-common\", pkgver:\"2.5.5-6ubuntu0.4\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"squidclient\", pkgver:\"2.5.5-6ubuntu0.4\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid / squid-cgi / squid-common / squidclient\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T02:26:29", "bulletinFamily": "scanner", "description": " - Mon May 16 2005 Jay Fenlason <fenlason at redhat.com>\n 7:2.5.STABLE9-1.FC3.6\n\n - More upstream patches, including ones for bz#157456\n CVE-2005-1519 DNS lookups unreliable on untrusted\n networks bz#156162 CVE-1999-0710 cachemgr.cgi access\n control bypass\n\n - The following bugs had already been fixed, but the\n announcements were lost bz#156711 CVE-2005-1390 HTTP\n Request Smuggling Vulnerabilities bz#156703\n CVE-2005-1389 HTTP Response Splitting Vulnerabilities\n (Both fixed by squid-7:2.5.STABLE8-1.FC3.1) bz#151419\n Unexpected access control results on configuration\n errors (Fixed by 7:2.5.STABLE9-1.FC3.2)\n bz#152647#squid-2.5.STABLE9-1.FC3.4.x86_64.rpm is broken\n (fixed by 7:2.5.STABLE9-1.FC3.5) bz#141938 squid ldap\n authentification broken (Fixed by 7:2.5.STABLE7-1.FC3)\n\n - Fri Apr 1 2005 Jay Fenlason <fenlason at redhat.com>\n 7:2.5.STABLE9-1.FC3.5\n\n - More upstream patches, including a new version of the\n -2GB patch that doesn", "modified": "2019-11-02T00:00:00", "id": "FEDORA_2005-373.NASL", "href": "https://www.tenable.com/plugins/nessus/18337", "published": "2005-05-19T00:00:00", "title": "Fedora Core 3 : squid-2.5.STABLE9-1.FC3.6 (2005-373)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2005-373.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(18337);\n script_version (\"1.16\");\n script_cvs_date(\"Date: 2019/08/02 13:32:24\");\n\n script_cve_id(\"CVE-1999-0710\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-1519\");\n script_xref(name:\"FEDORA\", value:\"2005-373\");\n\n script_name(english:\"Fedora Core 3 : squid-2.5.STABLE9-1.FC3.6 (2005-373)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Mon May 16 2005 Jay Fenlason <fenlason at redhat.com>\n 7:2.5.STABLE9-1.FC3.6\n\n - More upstream patches, including ones for bz#157456\n CVE-2005-1519 DNS lookups unreliable on untrusted\n networks bz#156162 CVE-1999-0710 cachemgr.cgi access\n control bypass\n\n - The following bugs had already been fixed, but the\n announcements were lost bz#156711 CVE-2005-1390 HTTP\n Request Smuggling Vulnerabilities bz#156703\n CVE-2005-1389 HTTP Response Splitting Vulnerabilities\n (Both fixed by squid-7:2.5.STABLE8-1.FC3.1) bz#151419\n Unexpected access control results on configuration\n errors (Fixed by 7:2.5.STABLE9-1.FC3.2)\n bz#152647#squid-2.5.STABLE9-1.FC3.4.x86_64.rpm is broken\n (fixed by 7:2.5.STABLE9-1.FC3.5) bz#141938 squid ldap\n authentification broken (Fixed by 7:2.5.STABLE7-1.FC3)\n\n - Fri Apr 1 2005 Jay Fenlason <fenlason at redhat.com>\n 7:2.5.STABLE9-1.FC3.5\n\n - More upstream patches, including a new version of the\n -2GB patch that doesn't break diskd.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/announce/2005-May/000911.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?08f99907\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected squid and / or squid-debuginfo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/05/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/05/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^3([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 3.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC3\", reference:\"squid-2.5.STABLE9-1.FC3.6\")) flag++;\nif (rpm_check(release:\"FC3\", reference:\"squid-debuginfo-2.5.STABLE9-1.FC3.6\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid / squid-debuginfo\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T03:20:10", "bulletinFamily": "scanner", "description": "An updated Squid package that fixes several security issues is now\navailable.\n\nSquid is a full-featured Web proxy cache.\n\nA buffer overflow flaw was found in the Gopher relay parser. This bug\ncould allow a remote Gopher server to crash the Squid proxy that reads\ndata from it. Although Gopher servers are now quite rare, a malicious\nweb page (for example) could redirect or contain a frame pointing to\nan attacker", "modified": "2019-11-02T00:00:00", "id": "REDHAT-RHSA-2005-061.NASL", "href": "https://www.tenable.com/plugins/nessus/16384", "published": "2005-02-14T00:00:00", "title": "RHEL 2.1 / 3 : squid (RHSA-2005:061)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2005:061. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16384);\n script_version (\"1.24\");\n script_cvs_date(\"Date: 2019/10/25 13:36:10\");\n\n script_cve_id(\"CVE-2005-0094\", \"CVE-2005-0095\", \"CVE-2005-0096\", \"CVE-2005-0097\", \"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\", \"CVE-2005-0241\");\n script_bugtraq_id(12276);\n script_xref(name:\"RHSA\", value:\"2005:061\");\n\n script_name(english:\"RHEL 2.1 / 3 : squid (RHSA-2005:061)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated Squid package that fixes several security issues is now\navailable.\n\nSquid is a full-featured Web proxy cache.\n\nA buffer overflow flaw was found in the Gopher relay parser. This bug\ncould allow a remote Gopher server to crash the Squid proxy that reads\ndata from it. Although Gopher servers are now quite rare, a malicious\nweb page (for example) could redirect or contain a frame pointing to\nan attacker's malicious gopher server. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CVE-2005-0094\nto this issue.\n\nAn integer overflow flaw was found in the WCCP message parser. It is\npossible to crash the Squid server if an attacker is able to send a\nmalformed WCCP message with a spoofed source address matching Squid's\n'home router'. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CVE-2005-0095 to this issue.\n\nA memory leak was found in the NTLM fakeauth_auth helper. It is\npossible that an attacker could place the Squid server under high\nload, causing the NTML fakeauth_auth helper to consume a large amount\nof memory, resulting in a denial of service. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0096 to this issue.\n\nA NULL pointer de-reference bug was found in the NTLM fakeauth_auth\nhelper. It is possible for an attacker to send a malformed NTLM type 3\nmessage, causing the Squid server to crash. The Common Vulnerabilities\nand Exposures project (cve.mitre.org) has assigned the name\nCVE-2005-0097 to this issue.\n\nA username validation bug was found in squid_ldap_auth. It is possible\nfor a username to be padded with spaces, which could allow a user to\nbypass explicit access control rules or confuse accounting. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0173 to this issue.\n\nThe way Squid handles HTTP responses was found to need strengthening.\nIt is possible that a malicious web server could send a series of HTTP\nresponses in such a way that the Squid cache could be poisoned,\npresenting users with incorrect webpages. The Common Vulnerabilities\nand Exposures project (cve.mitre.org) has assigned the names\nCVE-2005-0174 and CVE-2005-0175 to these issues.\n\nA bug was found in the way Squid handled oversized HTTP response\nheaders. It is possible that a malicious web server could send a\nspecially crafted HTTP header which could cause the Squid cache to be\npoisoned, presenting users with incorrect webpages. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0241 to this issue.\n\nA buffer overflow bug was found in the WCCP message parser. It is\npossible that an attacker could send a malformed WCCP message which\ncould crash the Squid server or execute arbitrary code. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0211 to this issue.\n\nUsers of Squid should upgrade to this updated package, which contains\nbackported patches, and is not vulnerable to these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0094\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0095\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0097\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0173\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0174\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0175\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0211\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0241\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_1.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_2.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_3.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Versions/v2/2.5/bugs/#\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?96864d1c\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2005:061\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected squid package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:2.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(2\\.1|3)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 2.1 / 3.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2005:061\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"squid-2.4.STABLE7-1.21as.4\")) flag++;\n\n if (rpm_check(release:\"RHEL3\", reference:\"squid-2.5.STABLE3-6.3E.7\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-01T03:20:10", "bulletinFamily": "scanner", "description": "An updated Squid package that fixes several security issues is now\navailable.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nSquid is a full-featured Web proxy cache.\n\nA buffer overflow flaw was found in the Gopher relay parser. This bug\ncould allow a remote Gopher server to crash the Squid proxy that reads\ndata from it. Although Gopher servers are now quite rare, a malicious\nwebpage (for example) could redirect or contain a frame pointing to an\nattacker", "modified": "2019-11-02T00:00:00", "id": "REDHAT-RHSA-2005-060.NASL", "href": "https://www.tenable.com/plugins/nessus/17176", "published": "2005-02-22T00:00:00", "title": "RHEL 4 : squid (RHSA-2005:060)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2005:060. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(17176);\n script_version (\"1.22\");\n script_cvs_date(\"Date: 2019/10/25 13:36:10\");\n\n script_cve_id(\"CVE-2005-0094\", \"CVE-2005-0095\", \"CVE-2005-0096\", \"CVE-2005-0097\", \"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\", \"CVE-2005-0241\");\n script_xref(name:\"RHSA\", value:\"2005:060\");\n\n script_name(english:\"RHEL 4 : squid (RHSA-2005:060)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated Squid package that fixes several security issues is now\navailable.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nSquid is a full-featured Web proxy cache.\n\nA buffer overflow flaw was found in the Gopher relay parser. This bug\ncould allow a remote Gopher server to crash the Squid proxy that reads\ndata from it. Although Gopher servers are now quite rare, a malicious\nwebpage (for example) could redirect or contain a frame pointing to an\nattacker's malicious gopher server. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CVE-2005-0094\nto this issue.\n\nAn integer overflow flaw was found in the WCCP message parser. It is\npossible to crash the Squid server if an attacker is able to send a\nmalformed WCCP message with a spoofed source address matching Squid's\n'home router'. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CVE-2005-0095 to this issue.\n\nA memory leak was found in the NTLM fakeauth_auth helper. It is\npossible that an attacker could place the Squid server under high\nload, causing the NTML fakeauth_auth helper to consume a large amount\nof memory, resulting in a denial of service. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0096 to this issue.\n\nA NULL pointer de-reference bug was found in the NTLM fakeauth_auth\nhelper. It is possible for an attacker to send a malformed NTLM type 3\nmessage, causing the Squid server to crash. The Common Vulnerabilities\nand Exposures project (cve.mitre.org) has assigned the name\nCVE-2005-0097 to this issue.\n\nA username validation bug was found in squid_ldap_auth. It is possible\nfor a username to be padded with spaces, which could allow a user to\nbypass explicit access control rules or confuse accounting. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0173 to this issue.\n\nThe way Squid handles HTTP responses was found to need strengthening.\nIt is possible that a malicious Web server could send a series of HTTP\nresponses in such a way that the Squid cache could be poisoned,\npresenting users with incorrect webpages. The Common Vulnerabilities\nand Exposures project (cve.mitre.org) has assigned the names\nCVE-2005-0174 and CVE-2005-0175 to these issues.\n\nA bug was found in the way Squid handled oversized HTTP response\nheaders. It is possible that a malicious Web server could send a\nspecially crafted HTTP header which could cause the Squid cache to be\npoisoned, presenting users with incorrect webpages. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0241 to this issue.\n\nA buffer overflow bug was found in the WCCP message parser. It is\npossible that an attacker could send a malformed WCCP message which\ncould crash the Squid server or execute arbitrary code. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the\nname CVE-2005-0211 to this issue.\n\nUsers of Squid should upgrade to this updated package, which contains\nbackported patches, and is not vulnerable to these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0094\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0095\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0097\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0173\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0174\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0175\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0211\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-0241\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_1.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_2.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Advisories/SQUID-2005_3.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.squid-cache.org/Versions/v2/2.5/bugs/#\"\n );\n # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?96864d1c\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2005:060\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected squid package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2005:060\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL4\", reference:\"squid-2.5.STABLE6-3.4E.3\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-03T12:18:10", "bulletinFamily": "scanner", "description": "The remote host is missing the patch for the advisory SUSE-SA:2005:006 (squid).\n\n\nSquid is a feature-rich web-proxy with support for various web-related\nprotocols.\nThe last two squid updates from February the 1st and 10th fix several\nvulnerabilities. The impact of them range from remote denial-of-service\nover cache poisoning to possible remote command execution.\nDue to the hugh amount of bugs the vulnerabilities are just summarized\nhere.\n\nCVE-2005-0094\nA buffer overflow in the Gopher responses parser leads\nto memory corruption and usually crash squid.\n\nCVE-2005-0095\nAn integer overflow in the receiver of WCCP (Web Cache\nCommunication Protocol) messages can be exploited remotely\nby sending a specially crafted UDP datagram to crash squid.\n\nCVE-2005-0096\nA memory leak in the NTLM fakeauth_auth helper for\nSquid 2.5.STABLE7 and earlier allows remote attackers\nto cause a denial-of-service due to uncontrolled memory\nconsumption.\n\nCVE-2005-0097 \nThe NTLM component in Squid 2.5.STABLE7 and earlier allows\nremote attackers to cause a crash od squid by sending a\nmalformed NTLM message. \n\nCVE-2005-0173\nLDAP handles search filters very laxly. This behaviour can\nbe abused to log in using several variants of a login name,\npossibly bypassing explicit access controls or confusing\naccounting.\n\nCVE-2005-0175 and CVE-2005-0174\nMinor problems in the HTTP header parsing code that\ncan be used for cache poisoning.\n\nCVE-2005-0211\nA buffer overflow in the WCCP handling code in Squid 2.5\nbefore 2.5.STABLE7 allows remote attackers to cause a\ndenial-of-service and possibly execute arbitrary code\nby using a long WCCP packet.\n\nCVE-2005-0241\nThe httpProcessReplyHeader function in Squid 2.5-STABLE7\nand earlier does not properly set the debug context when\nit is handling ", "modified": "2019-11-02T00:00:00", "id": "SUSE_SA_2005_006.NASL", "href": "https://www.tenable.com/plugins/nessus/16372", "published": "2005-02-10T00:00:00", "title": "SUSE-SA:2005:006: squid", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# This plugin text was extracted from SuSE Security Advisory SUSE-SA:2005:006\n#\n\n\nif ( ! defined_func(\"bn_random\") ) exit(0);\n\ninclude(\"compat.inc\");\n\nif(description)\n{\n script_id(16372);\n script_version (\"1.10\");\n if ( NASL_LEVEL >= 2200 ) script_cve_id(\"CVE-2005-0094\", \"CVE-2005-0095\", \"CVE-2005-0096\", \"CVE-2005-0097\", \"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\", \"CVE-2005-0241\");\n \n name[\"english\"] = \"SUSE-SA:2005:006: squid\";\n \n script_name(english:name[\"english\"]);\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a vendor-supplied security patch\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is missing the patch for the advisory SUSE-SA:2005:006 (squid).\n\n\nSquid is a feature-rich web-proxy with support for various web-related\nprotocols.\nThe last two squid updates from February the 1st and 10th fix several\nvulnerabilities. The impact of them range from remote denial-of-service\nover cache poisoning to possible remote command execution.\nDue to the hugh amount of bugs the vulnerabilities are just summarized\nhere.\n\nCVE-2005-0094\nA buffer overflow in the Gopher responses parser leads\nto memory corruption and usually crash squid.\n\nCVE-2005-0095\nAn integer overflow in the receiver of WCCP (Web Cache\nCommunication Protocol) messages can be exploited remotely\nby sending a specially crafted UDP datagram to crash squid.\n\nCVE-2005-0096\nA memory leak in the NTLM fakeauth_auth helper for\nSquid 2.5.STABLE7 and earlier allows remote attackers\nto cause a denial-of-service due to uncontrolled memory\nconsumption.\n\nCVE-2005-0097 \nThe NTLM component in Squid 2.5.STABLE7 and earlier allows\nremote attackers to cause a crash od squid by sending a\nmalformed NTLM message. \n\nCVE-2005-0173\nLDAP handles search filters very laxly. This behaviour can\nbe abused to log in using several variants of a login name,\npossibly bypassing explicit access controls or confusing\naccounting.\n\nCVE-2005-0175 and CVE-2005-0174\nMinor problems in the HTTP header parsing code that\ncan be used for cache poisoning.\n\nCVE-2005-0211\nA buffer overflow in the WCCP handling code in Squid 2.5\nbefore 2.5.STABLE7 allows remote attackers to cause a\ndenial-of-service and possibly execute arbitrary code\nby using a long WCCP packet.\n\nCVE-2005-0241\nThe httpProcessReplyHeader function in Squid 2.5-STABLE7\nand earlier does not properly set the debug context when\nit is handling 'oversized' HTTP reply headers. The impact\nis unknown.\" );\n script_set_attribute(attribute:\"solution\", value:\n\"http://www.suse.de/security/advisories/2005_06_squid.html\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n\n\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2005/02/10\");\n script_cvs_date(\"Date: 2019/10/25 13:36:28\");\n script_end_attributes();\n\n \n summary[\"english\"] = \"Check for the version of the squid package\";\n script_summary(english:summary[\"english\"]);\n \n script_category(ACT_GATHER_INFO);\n \n script_copyright(english:\"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.\");\n family[\"english\"] = \"SuSE Local Security Checks\";\n script_family(english:family[\"english\"]);\n \n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/SuSE/rpm-list\");\n exit(0);\n}\n\ninclude(\"rpm.inc\");\nif ( rpm_check( reference:\"squid-2.4.STABLE7-288\", release:\"SUSE8.1\") )\n{\n security_hole(0);\n exit(0);\n}\nif ( rpm_check( reference:\"squid-2.5.STABLE1-106\", release:\"SUSE8.2\") )\n{\n security_hole(0);\n exit(0);\n}\nif ( rpm_check( reference:\"squid-2.5.STABLE3-118\", release:\"SUSE9.0\") )\n{\n security_hole(0);\n exit(0);\n}\nif ( rpm_check( reference:\"squid-2.5.STABLE5-42.27\", release:\"SUSE9.1\") )\n{\n security_hole(0);\n exit(0);\n}\nif ( rpm_check( reference:\"squid-2.5.STABLE6-6.6\", release:\"SUSE9.2\") )\n{\n security_hole(0);\n exit(0);\n}\nif (rpm_exists(rpm:\"squid-\", release:\"SUSE8.1\")\n || rpm_exists(rpm:\"squid-\", release:\"SUSE8.2\")\n || rpm_exists(rpm:\"squid-\", release:\"SUSE9.0\")\n || rpm_exists(rpm:\"squid-\", release:\"SUSE9.1\")\n || rpm_exists(rpm:\"squid-\", release:\"SUSE9.2\") )\n{\n set_kb_item(name:\"CVE-2005-0094\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0095\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0096\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0097\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0173\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0174\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0175\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0211\", value:TRUE);\n set_kb_item(name:\"CVE-2005-0241\", value:TRUE);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-11-03T12:17:14", "bulletinFamily": "scanner", "description": "According to its version number, the remote Squid caching proxy is\naffected by several security flaws :\n\n - There is a buffer overflow when handling the reply of a\n rogue gopher site. (CVE-2005-0094)\n\n - There is a denial of service vulnerability in the WCCP\n code of the remote proxy. (CVE-2005-0095)\n\n - There is a buffer overflow in the WCCP code that may\n allow an attacker to execute arbitrary code on the\n remote host. (CVE-2005-0211)\n\n - There is a flaw in the ", "modified": "2019-11-02T00:00:00", "id": "SQUID_WCCP_AND_GOPHER_FLAWS.NASL", "href": "https://www.tenable.com/plugins/nessus/16190", "published": "2005-01-18T00:00:00", "title": "Squid < 2.5.STABLE8 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(16190);\n script_version(\"1.23\");\n script_cvs_date(\"Date: 2018/07/30 15:31:32\");\n\n script_cve_id(\"CVE-2005-0094\", \"CVE-2005-0095\", \"CVE-2005-0173\", \"CVE-2005-0174\", \"CVE-2005-0175\", \"CVE-2005-0211\", \"CVE-2005-0241\");\n script_bugtraq_id(12275, 12276, 12412, 12433, 12432, 12431, 13434, 13435);\n\n script_name(english:\"Squid < 2.5.STABLE8 Multiple Vulnerabilities\");\n script_summary(english:\"Determines squid version\");\n\n script_set_attribute(attribute:\"synopsis\", value:\"The remote proxy server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version number, the remote Squid caching proxy is\naffected by several security flaws :\n\n - There is a buffer overflow when handling the reply of a\n rogue gopher site. (CVE-2005-0094)\n\n - There is a denial of service vulnerability in the WCCP\n code of the remote proxy. (CVE-2005-0095)\n\n - There is a buffer overflow in the WCCP code that may\n allow an attacker to execute arbitrary code on the\n remote host. (CVE-2005-0211)\n\n - There is a flaw in the 'squid_ldap_auth' module that may\n allow an attacker to bypass authentication and to gain\n access to the remote proxy. (CVE-2005-0173)\n\n - There is a flaw in the way Squid parses HTTP reply\n headers. (CVE-2005-0241)\n\n - There is a weakness that may allow for cache poisoning\n via\n HTTP response splitting. (CVE-2005-0175)\n\n - There is a weakness that may allow for cache poisoning\n via\n crafted malformed headers. (CVE-2005-0174)\n\nNote that this may be a false-positive given the way the Squid team\nhandles releases. Make sure that all the appropriate patches have been\napplied.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.squid-cache.org/Versions/v2/2.5/bugs/\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to Squid 2.5.STABLE8 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/01/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/01/18\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:squid-cache:squid\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Firewalls\");\n\n script_dependencie(\"squid_version.nasl\");\n script_require_keys(\"www/squid\", \"Settings/ParanoidReport\");\n script_require_ports(\"Services/http_proxy\", 3128, 8080);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\n# Build a list of ports from the\nlist = get_kb_list(\"http_proxy/*/squid/version\");\nif (isnull(list)) exit(0, \"The host does not appear to be running a Squid proxy server.\");\n\nvulnerable = FALSE;\nforeach item (keys(list))\n{\n port = ereg_replace(pattern:'^http_proxy/([0-9]+)/squid/version', replace:'\\\\1', string:item);\n version = list[item];\n source = get_kb_item('http_proxy/'+port+'/squid/source');\n\n if (\n version =~ '^2\\\\.[0-4]\\\\.' ||\n version =~ '^2\\\\.5\\\\.STABLE[0-7]([^0-9]|$)'\n )\n {\n vulnerable = TRUE;\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + source +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 2.5.STABLE8' + '\\n';\n security_hole(port:port, extra:report);\n }\n else security_hole(port:port);\n }\n}\nif (!vulnerable)\n{\n exit(0, \"No vulnerable Squid installs were detected on the remote host.\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:43", "bulletinFamily": "unix", "description": "### Background\n\nSquid is a full-featured Web proxy cache designed to run on Unix systems. It supports proxying and caching of HTTP, FTP, and other protocols, as well as SSL support, cache hierarchies, transparent caching, access control lists and many other features. \n\n### Description\n\nSquid contains several vulnerabilities: \n\n * Buffer overflow when handling WCCP recvfrom() (CAN-2005-0211).\n * Loose checking of HTTP headers (CAN-2005-0173 and CAN-2005-0174).\n * Incorrect handling of LDAP login names with spaces (CAN-2005-0175).\n\n### Impact\n\nAn attacker could exploit: \n\n * the WCCP buffer overflow to cause Denial of Service.\n * the HTTP header parsing vulnerabilities to inject arbitrary response data, potentially leading to content spoofing, web cache poisoning and other cross-site scripting or HTTP response splitting attacks.\n * the LDAP issue to login with several variations of the same login name, leading to log poisoning.\n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll Squid users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-proxy/squid-2.5.7-r5\"", "modified": "2005-02-02T00:00:00", "published": "2005-02-02T00:00:00", "id": "GLSA-200502-04", "href": "https://security.gentoo.org/glsa/200502-04", "type": "gentoo", "title": "Squid: Multiple vulnerabilities", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "suse": [{"lastseen": "2016-09-04T11:18:00", "bulletinFamily": "unix", "description": "Squid is a feature-rich web-proxy with support for various web-related protocols. The last two squid updates from February the 1st and 10th fix several vulnerabilities. The impact of them range from remote denial-of-service over cache poisoning to possible remote command execution. Due to the hugh amount of bugs the vulnerabilities are just summarized here. CAN-2005-0094 A buffer overflow in the Gopher responses parser leads to memory corruption and usually crash squid.\n#### Solution\nThere is no workaround known.", "modified": "2005-02-10T15:13:39", "published": "2005-02-10T15:13:39", "id": "SUSE-SA:2005:006", "href": "http://lists.opensuse.org/opensuse-security-announce/2005-02/msg00015.html", "title": "remote command execution in squid", "type": "suse", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "redhat": [{"lastseen": "2019-08-13T18:45:57", "bulletinFamily": "unix", "description": "Squid is a full-featured Web proxy cache.\n\nA buffer overflow flaw was found in the Gopher relay parser. This bug\ncould allow a remote Gopher server to crash the Squid proxy that reads data\nfrom it. Although Gopher servers are now quite rare, a malicious webpage\n(for example) could redirect or contain a frame pointing to an attacker's\nmalicious gopher server. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0094 to this issue.\n\nAn integer overflow flaw was found in the WCCP message parser. It is\npossible to crash the Squid server if an attacker is able to send a\nmalformed WCCP message with a spoofed source address matching Squid's\n\"home router\". The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0095 to this issue.\n\nA memory leak was found in the NTLM fakeauth_auth helper. It is possible\nthat an attacker could place the Squid server under high load, causing the\nNTML fakeauth_auth helper to consume a large amount of memory, resulting in\na denial of service. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0096 to this issue.\n\nA NULL pointer de-reference bug was found in the NTLM fakeauth_auth helper.\nIt is possible for an attacker to send a malformed NTLM type 3 message,\ncausing the Squid server to crash. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2005-0097 to\nthis issue.\n\nA username validation bug was found in squid_ldap_auth. It is possible for\na username to be padded with spaces, which could allow a user to bypass\nexplicit access control rules or confuse accounting. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2005-0173 to this issue.\n\nThe way Squid handles HTTP responses was found to need strengthening. It is\npossible that a malicious Web server could send a series of HTTP responses\nin such a way that the Squid cache could be poisoned, presenting users with\nincorrect webpages. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the names CAN-2005-0174 and CAN-2005-0175 to\nthese issues.\n\nA bug was found in the way Squid handled oversized HTTP response headers.\nIt is possible that a malicious Web server could send a specially crafted\nHTTP header which could cause the Squid cache to be poisoned, presenting\nusers with incorrect webpages. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2005-0241 to this issue.\n\nA buffer overflow bug was found in the WCCP message parser. It is possible\nthat an attacker could send a malformed WCCP message which could crash the\nSquid server or execute arbitrary code. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2005-0211\nto this issue.\n\nUsers of Squid should upgrade to this updated package, which contains\nbackported patches, and is not vulnerable to these issues.", "modified": "2017-09-08T12:11:54", "published": "2005-02-15T05:00:00", "id": "RHSA-2005:060", "href": "https://access.redhat.com/errata/RHSA-2005:060", "type": "redhat", "title": "(RHSA-2005:060) squid security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-08-13T18:47:15", "bulletinFamily": "unix", "description": "Squid is a full-featured Web proxy cache.\n\nA buffer overflow flaw was found in the Gopher relay parser. This bug\ncould allow a remote Gopher server to crash the Squid proxy that reads data\nfrom it. Although Gopher servers are now quite rare, a malicious web page\n(for example) could redirect or contain a frame pointing to an attacker's\nmalicious gopher server. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0094 to this issue.\n\nAn integer overflow flaw was found in the WCCP message parser. It is\npossible to crash the Squid server if an attacker is able to send a\nmalformed WCCP message with a spoofed source address matching Squid's\n\"home router\". The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0095 to this issue.\n\nA memory leak was found in the NTLM fakeauth_auth helper. It is possible\nthat an attacker could place the Squid server under high load, causing the\nNTML fakeauth_auth helper to consume a large amount of memory, resulting in\na denial of service. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0096 to this issue.\n\nA NULL pointer de-reference bug was found in the NTLM fakeauth_auth helper.\nIt is possible for an attacker to send a malformed NTLM type 3 message,\ncausing the Squid server to crash. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2005-0097 to\nthis issue.\n\nA username validation bug was found in squid_ldap_auth. It is possible for\na username to be padded with spaces, which could allow a user to bypass\nexplicit access control rules or confuse accounting. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2005-0173 to this issue.\n\nThe way Squid handles HTTP responses was found to need strengthening. It is\npossible that a malicious web server could send a series of HTTP responses\nin such a way that the Squid cache could be poisoned, presenting users with\nincorrect webpages. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the names CAN-2005-0174 and CAN-2005-0175 to\nthese issues.\n\nA bug was found in the way Squid handled oversized HTTP response headers.\nIt is possible that a malicious web server could send a specially crafted\nHTTP header which could cause the Squid cache to be poisoned, presenting\nusers with incorrect webpages. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2005-0241 to this issue.\n\nA buffer overflow bug was found in the WCCP message parser. It is possible\nthat an attacker could send a malformed WCCP message which could crash the\nSquid server or execute arbitrary code. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2005-0211\nto this issue.\n\nUsers of Squid should upgrade to this updated package, which contains\nbackported patches, and is not vulnerable to these issues.", "modified": "2019-03-22T23:43:19", "published": "2005-02-11T05:00:00", "id": "RHSA-2005:061", "href": "https://access.redhat.com/errata/RHSA-2005:061", "type": "redhat", "title": "(RHSA-2005:061) squid security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}