[Full-Disclosure] iDEFENSE Security Advisory 10.11.04: Squid Web Proxy Cache Remote Denial of Service Vulnerability

Squid Web Proxy Cache Remote Denial of Service Vulnerability iDEFENSE Security Advisory 10.11.04: www.idefense.com/application/poi/display?id=152&type=vulnerabilities October 11, 2004 I. BACKGROUND Squid Web Proxy Cache is a full-featured web proxy cache designed to run on Unix systems. It suppor...

squid SNMP DoS

ASN.1 parsing problems...

Squid 2.5.x < 2.5.STABLE8 Information Disclosure

Binary data 2448.prm...

Fedora Core 2 : squid-2.5.STABLE5-4.fc2 (2004-330)

This update fixes a potential DoS against squid that was reported by Secunia. See http://secunia.com/advisories/12508/ for details. - Fri Oct 1 2004 Jay Fenlason 7:2.5.STABLE3-4.fc2.1 - Modify the entry for /etc/squid.conf in this spec file to set the permissions to 640 owned by root:squid. This...

RHEL 3 : squid (RHSA-2004:462)

An updated squid package that fixes a security vulnerability in the NTLM authentication helper is now available. Squid is a full-featured Web proxy cache. An out of bounds memory read bug was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authenticatio...

security flaw

The 1 ntlmfetchstring and 2 ntlmgetstring functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service application crash via an NTLMSSP packet that causes a negative value to be passed to memcpy...

Moderate: Red Hat Security Advisory: squid security update

An updated squid package that fixes a security vulnerability in the NTLM authentication helper is now available. Squid is a full-featured Web proxy cache. An out of bounds memory read bug was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authenticatio...

Debian DSA-077-1 : squid - remote DoS

Vladimir Ivaschenko found a problem in squid a popular proxy cache. He discovered that there was a flaw in the code to handle FTP PUT commands: when a mkdir-only request was done squid would detect an internal error and exit. Since squid is configured to restart itself on problems this is not a b...

Debian DSA-474-1 : squid - ACL bypass

A vulnerability was discovered in squid, an Internet object cache, whereby access control lists based on URLs could be bypassed CAN-2004-0189. Two other bugs were also fixed with patches squid-2.4.STABLE7-urlescape.patch a buffer overrun which does not appear to be exploitable and...

squid -- SNMP module denial-of-service vulnerability

The Squid-2.5 patches page notes: If a certain malformed SNMP request is received squid restarts with a Segmentation Fault error. This only affects squid installations where SNMP is explicitly enabled via "make config". As a workaround, SNMP can be disabled by defining "snmpport 0" in squid.conf...

CVE-2004-0832

The 1 ntlmfetchstring and 2 ntlmgetstring functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service application crash via an NTLMSSP packet that causes a negative value to be passed to memcpy...

CVE-2004-0832

CVE-2004-0832 affects Squid 2.5.6 and earlier when NTLM authentication is enabled. The vulnerability allows a remote attacker to trigger a denial of service (application crash) by sending an NTLMSSP packet that causes a negative value to be passed to memcpy. Affected component: ntlm_fetch_string ...

CVE-2004-0832

The 1 ntlmfetchstring and 2 ntlmgetstring functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service application crash via an NTLMSSP packet that causes a negative value to be passed to memcpy...

CVE-2004-0832: Undefined Security Weakness

The 1 ntlmfetchstring and 2 ntlmgetstring functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service application crash via an NTLMSSP packet that causes a negative value to be passed to memcpy...

Mandrake Linux Security Advisory : squid (MDKSA-2004:093)

A vulnerability in the NTLM helpers in squid 2.5 could allow for malformed NTLMSSP packets to crash squid, resulting in a DoS. The provided packages have been patched to prevent this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

squid buffer overflow

Buffer overflow if NTLM authentication is compiled...

MDKSA-2004:093 - Updated squid packages fix DoS vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrakelinux Security Update Advisory Package name: squid Advisory ID: MDKSA-2004:093 Date: September 15th, 2004 Affected versions: 10.0, 9.2 Problem Description: A vulnerability in the NTLM helpers in squid 2.5 could allow for malformed NTLMSSP...

Squid < 2.5.STABLE7 NTLM Authentication DoS

Binary data 2255.prm...

[ GLSA 200409-04 ] Squid: Denial of service when using NTLM authentication

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

GLSA-200409-04 : Squid: Denial of service when using NTLM authentication

The remote host is affected by the vulnerability described in GLSA-200409-04 Squid: Denial of service when using NTLM authentication Squid 2.5.x versions contain a bug in the functions ntlmfetchstring and ntlmgetstring which lack checking the int32t offset 'o' for negative values. Impact : A remo...