squid -- Denial Of Service Vulnerability in sslConnectTimeout

The squid patches page notes: After certain slightly odd requests Squid crashes with a segmentation fault in sslConnectTimeout...

Squid Set-Cookie Header Cross-session Information Disclosure

The remote Squid caching proxy, according to its banner, is prone to an information disclosure vulnerability. Due to a race condition, Set-Cookie headers may leak to other users if the requested server employs the deprecated Netscape Set-Cookie specifications with regards to how cacheable content...

FreeBSD : squid -- correct handling of oversized HTTP reply headers (bfda39de-7467-11d9-9e1e-c296ac722cb3)

The squid patches page notes : This patch addresses a HTTP protocol mismatch related to oversized reply headers. In addition it enhances the cache.log reporting on reply header parsing failures to make it easier to track down which sites are malfunctioning. It is believed that this bug may lead t...

FreeBSD : squid -- possible information disclosure (f0db930b-496b-11d9-bf86-0050569f0001)

The squid-2.5 patches pages notes : In certain conditions Squid returns random data as error messages in response to malformed host name, possibly leaking random internal information which may come from other requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)

The squid patches page notes : This patch makes Squid considerably stricter while parsing the HTTP protocol. - A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache t...

FreeBSD : squid -- HTTP response splitting cache pollution attack (4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3)

According to a whitepaper published by Sanctum, Inc., it is possible to mount cache poisoning attacks against, among others, squid proxies by inserting false replies into the HTTP stream. The squid patches page notes : This patch additionally strengthens Squid from the HTTP response attack...

FreeBSD : squid (1901)

The following package needs to be updated: squid %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-2006 Jacques Vidrine and contributors Redistribution and use in source VuXML and 'compiled' forms SGML, HTML, PDF, PostScrip...

FreeBSD : squid -- DoS on failed PUT/POST requests vulnerability (8dbf7894-a9a8-11d9-a788-0001020eed82)

The squid patches page notes : An inconsistent state is entered on a failed PUT/POST request making a high risk for segmentation faults or other strange errors %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeB...

FreeBSD : squid -- DNS lookup spoofing vulnerability (7e97b288-c7ca-11d9-9e1e-c296ac722cb3)

The squid patches page notes : Malicious users may spoof DNS lookups if the DNS client UDP port random, assigned by OS as startup is unfiltered and your network is not protected from IP spoofing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : squid -- possible abuse of cachemgr.cgi (a395397c-c7c8-11d9-9e1e-c296ac722cb3)

The squid patches page notes : This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

FreeBSD : squid -- no sanity check of usernames in squid_ldap_auth (7a921e9e-68b1-11d9-9e1e-c296ac722cb3)

The LDAP authentication helper did not strip leading or trailing spaces from the login name. According to the squid patches page : LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access...

FreeBSD : squid -- buffer overflow vulnerability in gopherToHTML (184ab9e0-64cd-11d9-9e1e-c296ac722cb3)

The squid patches page notes : A malicious gopher server may return a response with very long lines that cause a buffer overflow in Squid. Workaround: Since gopher is very obscure these days, do not allow Squid to any gopher servers. Use an ACL rule like : acl Gopher proto gopher httpaccess deny...

FreeBSD : squid -- confusing results on empty acl declarations (a30e5e44-5440-11d9-9e1e-c296ac722cb3)

Applying an empty ACL list results in unexpected behavior : anything will match an empty ACL list. For example, The meaning of the configuration gets very confusing when we encounter empty ACLs such as acl something src '/path/to/emptyfile.txt' httpaccess allow something somewhere gets parsed wit...

FreeBSD : squid -- buffer overflow in WCCP recvfrom() call (23fb5a04-722b-11d9-9e1e-c296ac722cb3)

According to the Squid Proxy Cache Security Update Advisory SQUID-2005:3, The WCCP recvfrom call accepts more data than will fit in the allocated buffer. An attacker may send a larger-than-normal WCCP message to Squid and overflow this buffer. Severity : The bug is important because it allows...

FreeBSD : squid -- NTLM authentication denial-of-service vulnerability (064225c5-1f53-11d9-836a-0090962cff2a)

A remote attacker is able to cause a denial-of-service situation, when NTLM authentication is enabled in squid. NTLM authentication uses two functions which lack correct offset checking. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

FreeBSD : squid -- denial of service with forged WCCP messages (5fe7e27a-64cb-11d9-9e1e-c296ac722cb3)

The squid patches page notes : WCCPISEEYOU messages contain a 'number of caches' field which should be between 1 and 32. Values outside that range may crash Squid if WCCP is enabled, and if an attacker can spoof UDP packets with the WCCP router's IP address. %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD : squid -- denial-of-service vulnerabilities (5bf1a715-cc57-440f-b0a5-6406961c54a7)

The Squid team reported several denial-of-service vulnerabilities related to the handling of DNS responses and NT Lan Manager messages. These may allow an attacker to crash the Squid cache. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

[SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 751-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...

Squid proxy server DNS reply spoofing

Blind DNS server reply spoofing is possible...

[SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 751-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...