Mandrake Linux Security Advisory : squid (MDKSA-2005:078)

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

CVE-2005-1345

CVE-2005-1345 affects Squid up to version 2.5.STABLE9, where missing or invalid http_access ACLs do not trigger a fatal error, potentially allowing broader access than intended. The initial description explicitly notes the ACL error in Squid’s http_access handling. Connected advisories identify a...

CVE-2005-1345

Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the httpaccess configuration, which could lead to less restrictive ACLs than intended by the administrator...

[Full-disclosure] iDEFENSE Security Advisory 04.18.05: McAfee Internet Security Suite 2005 Insecure File Permission Vulnerability

McAfee Internet Security Suite 2005 Insecure File Permission Vulnerability iDEFENSE Security Advisory 04.18.05 http://www.idefense.com/application/poi/display?type=vulnerabilities April 18, 2005 I. BACKGROUND McAfee Internet Security Suite 2005 is a product used to protect a personal computer fro...

CVE-2005-1107

McAfee Internet Security Suite 2005 uses insecure default ACLs for installed files, which allows local users to gain privileges or disable protection by modifying certain files...

[Full-disclosure] BakBone products multiple vulnerabilities

The Hat-Squad has found 2 exploitable vulnerabilities affecting BakBone NetVault Backup Software 6.x/7.x At this moment writing this advisory, no decent communications were established with the BakBone technicians, we recommand to set strict ACL rules on the files configure.cfg and to filter all...

[Hat-Squad Advisory] Bakbone NetVault Heap overflow Vulnerabilities

Hat-Squad Advisory: BakBone NetVault Remote Heap and Local Buffer Overflow April 1, 2005 Product: BakBone NetVault Vendor URL: http://www.bakbone.com Version: NetVault 7.x, 6.x Vulnerability: Remote and Local Heap Buffer overflows Release Date:1 April 2005 Vendor Status: 17-3-2005: vendor notifie...

GLSA-200501-25 : Squid: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200501-25 Squid: Multiple vulnerabilities Squid contains a vulnerability in the gopherToHTML function CAN-2005-0094 and incorrectly checks the 'number of caches' field when parsing WCCPISEEYOU messages CAN-2005-0095. Furthermore t...

CVE-2004-1463

CVE-2004-1463 concerns MoinMoin 1.2.2 and earlier, where an ACL handling issue in the PageEditor could allow a remote attacker to gain elevated privileges. The vulnerability is described as due to an undisclosed ACL flaw, with the impact described as elevated access to administrative functions (e...

Frox transparent FTP proxy protection bypass

Deny ACLs may not work properly...

[SA14182] Frox Deny ACL Security Bypass Vulnerability

TITLE: Frox Deny ACL Security Bypass Vulnerability SECUNIA ADVISORY ID: SA14182 VERIFY ADVISORY: http://secunia.com/advisories/14182/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: Frox 0.x http://secunia.com/product/4619/ DESCRIPTION: A vulnerability has been...

CVE-2005-0173

Summary: CVE-2005-0173 affects Squid 2.5 and earlier, where squid_ldap_auth may bypass username-based ACLs when a username has spaces at the start or end, ignored by the LDAP server. The issue enables potential unauthorized access as the LDAP handling laxity can lead to bypassing explicit ACLs (i...

CVE-2005-0194

Squid 2.5, when processing the configuration file, parses empty Access Control Lists ACLs, including proxyauth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warning...

Squid < 2.5.STABLE7 Report Information Disclosure

Binary data 2491.prm...

CVE-2004-2559

DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including 1 Mediaselectiondialog, 2 Recent changes, 3 feed, and 4 search, possibly due to the lack of ACL checks...

CVE-2004-2154

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive...

squid -- confusing results on empty acl declarations

Applying an empty ACL list results in unexpected behavior: anything will match an empty ACL list. For example, The meaning of the configuration gets very confusing when we encounter empty ACLs such as acl something src "/path/to/emptyfile.txt" httpaccess allow something somewhere gets parsed with...

CVE-2004-1023

Affected software: Kerio Winroute Firewall (&lt;6.0.9), ServerFirewall (&lt;1.0.1), and MailServer (

BSD bmon 1.2.1_2 - Local acls Bypass

!/usr/local/bin/bash Written by Idan Nahoum. [email protected] local exploit for FreeBSD/OpenBSD with bmon default: $BMONEXEC" "$" -gt "0" && BMONEXEC="$1" -x "$BMONEXEC" || echo "$BMONEXEC not found" exit cd /tmp apparently bmon closes stdout, so we run a shell with stdout redirected to stderr. cat...

Debian DSA-474-1 : squid - ACL bypass

A vulnerability was discovered in squid, an Internet object cache, whereby access control lists based on URLs could be bypassed CAN-2004-0189. Two other bugs were also fixed with patches squid-2.4.STABLE7-urlescape.patch a buffer overrun which does not appear to be exploitable and...