oss-sec mailing list archives
Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs
From: Henrik Nordström <henrik () henriknordstrom net>
Date: Fri, 13 Aug 2010 12:31:20 +0200
It's just bugs in the snmp initialization code and not considered a security issue. But the invalid free may result in free heap corruption (subject to quality of malloc implementation) which may then cause stability issues later on. Both issues were introduced in 3.1.4 and found in an project internal code quality audit. Regards Henrik Nordström Squid HTTP Proxy project fre 2010-08-13 klockan 09:00 +0200 skrev Thomas Biege:
Hello project maintainers, we stumbled over two bugs in your last release because they sound like security vulnerabilities. Can you shed some light on them for us please? Thanks Thomas Am Donnerstag, 12. August 2010, 20:58:13 schrieb Josh Bressers:----- "Thomas Biege" <thomas () suse de> wrote:Hello people, does someone know if this bug has security implications. TIA! http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID_3_1_5.html http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10008.pat chThis is really two flaws. The first bit of the patch is an off by one on the loop that could overflow a heap buffer. From looking at the code, I only see this function being called with static strings for the MIBs. I may be missing something, but it doesn't appear that arbitrary strings make it into this. I'm not sure if this can be exploted, or if it's just a bug someone noticed. The second flaw is an invalid free. I'm not sure if arbitrary data can make it into this, but with current glibc memory protections, this should be a DoS only. Both only seem to affect modern versions of squid. The code seems present in 3.1.4, but not 2.6.STABLE21 (these are two versions we ship). Have you mailed upstream at all? Thanks.
Current thread:
- RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs Thomas Biege (Aug 02)
- Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs Josh Bressers (Aug 12)
- Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs Thomas Biege (Aug 13)
- Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs Henrik Nordström (Aug 13)
- Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs Thomas Biege (Aug 13)
- Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs Josh Bressers (Aug 12)