AusCERT - AL-2008.0125 -- [Win][UNIX/Linux] -- Squid - Denial of service in cache updates

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
AL-2008.0125 -- [Win][UNIX/Linux] -- Squid - Denial of service in cache updates
Date: 16 April 2008
References: ESB-2008.0950 AU-2008.0024

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0125 -- AUSCERT ALERT
                             [Win][UNIX/Linux]
                Squid - Denial of service in cache updates
                               16 April 2008

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Squid
Publisher:            Squid
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-1612

Revision History:        April 16 2008: Updated the advisory announcing the 
                                        fix in Squid 2.6.STABLE18, Squid-2: 
                                        November 28 snapshot + additional 
                                        patch on January 09
                          April 8 2008: Added CVE information
                      December  7 2007: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

__________________________________________________________________

      Squid Proxy Cache Security Update Advisory SQUID-2007:2
__________________________________________________________________

Advisory ID:            SQUID-2007:2
Date:                   November 27, 2007
Summary:                Denial of service in cache updates
Affected versions:      Squid 2.X (2.0 -> 2.6.STABLE17); Squid-3 beta
Fixed in version:       Squid 2.6.STABLE18;
			Squid-2: November 28 snapshot + additional patch
			on January 09.
			Squid-3: November 28 snapshot
Author:			Adrian Chadd
Thanks:			Wikimedia Foundation

__________________________________________________________________

     http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
__________________________________________________________________

Problem Description:

 Due to incorrect bounds checking Squid is vulnerable to
 a denial of service check during some cache update reply
 processing.

__________________________________________________________________

Severity:

 This problem allows any client trusted to use the service to
 perform a denial of service attack on the Squid service.

__________________________________________________________________

Updated Packages:

 This bug is fixed by Squid version 2.6.STABLE18 and by the January
 09 snapshots of Squid-2 and November 28 snapshot of Squid-3.

 In addition, the two patches addressing this problem can be found in
 our patch archive for version Squid-2.6:
 
  http://www.squid-cache.org/Versions/v2/2.6/changesets/11780.patch (Nov 28)
  http://www.squid-cache.org/Versions/v2/2.6/changesets/11882.patch (Jan 09)

 And the patch for Squid-3:

  http://www.squid-cache.org/Versions/v3/3.0/changesets/11211.patch (Nov 28)

 If you are using a prepackaged version of Squid then please refer
 to the package vendor for availability information on updated
 packages.

 Note: Earlier version of this advisory said November 28 / 2.6.STABLE17
 for Squid-2.6, but that patch was incomplete and did not fully
 address the issue.
__________________________________________________________________

Determining if your version is vulnerable:

 All Squid-2.X versions up to, and including 2.6.STABLE17 are
 vulnerable.

 All Squid-3 snapshots and prereleases up to the November 28
 snapshot are vulnerable.

__________________________________________________________________

Workarounds:

 There are no workarounds.

__________________________________________________________________

Thanks to:

 Thanks go to the Wikimedia Foundation for helping identify the issue
 and testing the proposed resolution of the issue.

 Thanks to Adrian Chadd for the Squid-2 fix.

 Thanks to Henrik Nordstrom for the Squid-3 fix.

__________________________________________________________________

Contact details for the Squid project:

 For installation / upgrade support on binary packaged versions
 of Squid: Your first point of contact should be your binary
 package vendor.

 If your install and build Squid from the original Squid sources
 then the squid-users@squid-cache.org mailing list is your primary
 support point. See <http://www.squid-cache.org/mailing-lists.html>
 for subscription details.

 For reporting of non-security bugs in the latest STABLE release
 the squid bugzilla database should be used
 <http://www.squid-cache.org/bugs/>.

 For reporting of security sensitive bugs send an email to the
 squid-bugs@squid-cache.org mailing list. It's a closed list
 (though anyone can post) and security related bug reports are
 treated in confidence until the impact has been established.

__________________________________________________________________

Revision history:

 2007-11-26 14:40 GMT+9 Initial version
 2008-03-21 23:55 GMT   Squid-2.6.STABLE17 issue mentioned, bumping
			fixed to 2.6.STABLE18
__________________________________________________________________
END
- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSAWa0Ch9+71yA2DNAQKKZwP/WZMLhf+bK6YIHsW84zEWk9NrR6+A9ss9
Qcuovy/kceKJt7m93Fc+UYdcWP9dSH86sTQpbTQ64yOgFNKSPaLEbSbvewnFJF3T
7XaDXG8gPuuwf58KunZ7dckRvxynQTYLxKutZbMUbzfN7ykzzQXb6YtfF+30G3rS
lmLrGac+c3w=
=33vY
-----END PGP SIGNATURE-----