FreeBSD : squid -- possible cache-poisoning via malformed HTTP responses (b4d94fa0-6e38-11d9-9e1e-c296ac722cb3)

The squid patches page notes : This patch makes Squid considerably stricter while parsing the HTTP protocol. - A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache t...

FreeBSD : squid -- correct handling of oversized HTTP reply headers (bfda39de-7467-11d9-9e1e-c296ac722cb3)

The squid patches page notes : This patch addresses a HTTP protocol mismatch related to oversized reply headers. In addition it enhances the cache.log reporting on reply header parsing failures to make it easier to track down which sites are malfunctioning. It is believed that this bug may lead t...

FreeBSD : squid -- buffer overflow in WCCP recvfrom() call (23fb5a04-722b-11d9-9e1e-c296ac722cb3)

According to the Squid Proxy Cache Security Update Advisory SQUID-2005:3, The WCCP recvfrom call accepts more data than will fit in the allocated buffer. An attacker may send a larger-than-normal WCCP message to Squid and overflow this buffer. Severity : The bug is important because it allows...

FreeBSD : squid -- NTLM authentication denial-of-service vulnerability (064225c5-1f53-11d9-836a-0090962cff2a)

A remote attacker is able to cause a denial-of-service situation, when NTLM authentication is enabled in squid. NTLM authentication uses two functions which lack correct offset checking. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

FreeBSD : squid -- possible abuse of cachemgr.cgi (a395397c-c7c8-11d9-9e1e-c296ac722cb3)

The squid patches page notes : This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

FreeBSD : squid -- no sanity check of usernames in squid_ldap_auth (7a921e9e-68b1-11d9-9e1e-c296ac722cb3)

The LDAP authentication helper did not strip leading or trailing spaces from the login name. According to the squid patches page : LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access...

FreeBSD : squid -- DNS lookup spoofing vulnerability (7e97b288-c7ca-11d9-9e1e-c296ac722cb3)

The squid patches page notes : Malicious users may spoof DNS lookups if the DNS client UDP port random, assigned by OS as startup is unfiltered and your network is not protected from IP spoofing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : squid -- confusing results on empty acl declarations (a30e5e44-5440-11d9-9e1e-c296ac722cb3)

Applying an empty ACL list results in unexpected behavior : anything will match an empty ACL list. For example, The meaning of the configuration gets very confusing when we encounter empty ACLs such as acl something src '/path/to/emptyfile.txt' httpaccess allow something somewhere gets parsed wit...

FreeBSD : squid -- buffer overflow vulnerability in gopherToHTML (184ab9e0-64cd-11d9-9e1e-c296ac722cb3)

The squid patches page notes : A malicious gopher server may return a response with very long lines that cause a buffer overflow in Squid. Workaround: Since gopher is very obscure these days, do not allow Squid to any gopher servers. Use an ACL rule like : acl Gopher proto gopher httpaccess deny...

FreeBSD : squid -- denial-of-service vulnerabilities (5bf1a715-cc57-440f-b0a5-6406961c54a7)

The Squid team reported several denial-of-service vulnerabilities related to the handling of DNS responses and NT Lan Manager messages. These may allow an attacker to crash the Squid cache. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

FreeBSD : squid -- denial of service with forged WCCP messages (5fe7e27a-64cb-11d9-9e1e-c296ac722cb3)

The squid patches page notes : WCCPISEEYOU messages contain a 'number of caches' field which should be between 1 and 32. Values outside that range may crash Squid if WCCP is enabled, and if an attacker can spoof UDP packets with the WCCP router's IP address. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 751-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...

Squid proxy server DNS reply spoofing

Blind DNS server reply spoofing is possible...

[SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 751-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 751-1] New squid packages fix IP spoofing vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 751-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...

DSA-751-1 squid - IP spoofing

Bulletin has no description...

Debian DSA-751-1 : squid - IP spoofing

The upstream developers have discovered a bug in the DNS lookup code of Squid, the popular WWW proxy cache. When the DNS client UDP port assigned by the operating system at startup is unfiltered and the network is not protected from IP spoofing, malicious users can spoof DNS lookups which could...

Mandrake Linux Security Advisory : squid (MDKSA-2005:104)

A bug was found in the way that Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall, it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. %NASLMINLEVEL 70300 C Tenable Network Security...

RHEL 4 : squid (RHSA-2005:415)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:415 advisory. Squid is a full-featured Web proxy cache. A race condition bug was found in the way Squid handles the now obsolete Set-Cookie header. It is...

squid security update

CentOS Errata and Security Advisory CESA-2005:415 An updated squid package that fixes several security issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Squid is a full-featured Web proxy cache. A race condition bug was found ...