|
|
|
Vulnerability Note VU#613459Squid Proxy Server contains buffer overflow in parsing of the authentication portion of FTP URLsOverviewThere is a remotely exploitable buffer overflow in the Squid proxy/cache server. Exploitation of this vulnerability could lead to an intruder gaining a shell on the target Squid server.I. DescriptionSquid versions 2.3 and 2.4 are vulnerable to a buffer overflow in the code that parses FTP requests. A crafted FTP request can cause a Squid child process to dump core, and multiple requests can cause a denial of service. It is also reported that this vulnerability may be exploitable to allow arbitrary execution of code. This is not yet confirmed, and does not seem to be a trivial task. In order to exploit this vulnerability, the attacker must be a local user, or the server must permit anonymous logins.II. ImpactExploitation of this vulnerability results in a denial of service. It could also permit an intruder to execute arbitrary code on the target Squid server with the privileges of the Squid process, usually super-user/root. Note that exploiting this vulnerability to execute arbitrary code is not yet confirmed.III. SolutionUpgrade to Squid-2.4.STABLE4 or apply the patches provided by your vendor.Configure the Squid server to drop super-user/root privilege by specifying the chroot option used in squid.conf. If this is done, the attacker will only be able to execute arbitrary code as the user specified in the configuration file.
References
Our thanks to Jouko Pynnönen of Online Solutions Ltd, who discovered and reported on this vulnerability. This document was written by Jason Rafail and is based on the advisory by Jouko Pynnönen.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Get Adobe Reader