oss-sec mailing list archives
CVE Request: Squid HTTP Proxy Denial of Service
From: Amos Jeffries <squid3 () treenet co nz>
Date: Fri, 18 Sep 2015 12:58:26 +1200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, The TLS/SSL parser in the latest series of Squid HTTP Proxy has been found to have several bugs leading to Denial of Service possibilities. Can CVE be assigned as appropriate please? Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are built with OpenSSL and configured for "SSL-Bump" decryption. Integer overflows can lead to invalid pointer math reading from random memory on some CPU architectures. In the best case this leads to wrong TLS extensiosn being used for the client, worst-case a crash of the proxy terminating all active transactions. Fixed by <http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13914.p atch>. Incorrect message size checks and assumptions about the existence of TLS extensions in the SSL/TLS handshake message can lead to very high CPU consumption (up to and including 'infinite loop' behaviour). Fixed by <http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13915.p atch>. The above can be triggered remotely. Though there is one layer of authorization applied before this processing to check that the client is allowed to use the proxy, that check is generally weak. MS Skype on Windows XP is known to trigger some of these. (Formal release with advisory will be coming in a few days. 3.5.9 tarballs are available now, via FTP if the web mirrors ). Amos Jeffries Squid Software Foundation -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBAgAGBQJV+2F7AAoJEGvSOzfXE+nLdygQAI1SaDkmAic6RBAik92SaZsz fRizZC4y8ffnh70HZc9O3Z79sMmTD7q+HC/QKS0zSHSyzc+mDb4J9WjVfyr/DOJM MG1mr/QIWqqF4v+x+P1PEYmK68uHvuD4gqZZ+A/JQH1ZUt60OkRo4+wF3c8WukPG YUB6OTmAfPmE3W9Sp06mJ8irtzNQKibp6P+NBWSfjthxKTvmHKWp/MINZj3b3LBb n/QgRVYiHSeiHZTHJ0yLNIG+jcgBh68AVJZ5LpbHSfLGfQnAOmyuMdKmXdiMw0xL Qjb2g3sVU15WPgMQQvbSVI1W0Fla9WOhq1+XGtu+bUd82wx8P7J7Vpi/tA1dLERr lBir5CCZYXEp/WsFVkGnGCn5jV04CZ7kLACmlBIvXEWdKs1nUsIOTNCaGhfdpX2h KTejb//5L2zmTRE8e1dssfR1zO1nL8zTwujKXmWMX9QW09GlGkr/FNZEfvFwV1GN FaLII/QfH2YPKAuJCJevvXhozwTiKbbB6OG0VyGoMxcJoQ4TTbeXeXKqr/B1ax6t zeY5Tb5tETYSYRfKNbVisGC8j+dd1e/TklQxQvXZ8kP1ySyVSZ6cMkJlsQu3vFQ7 b5kkVyfOgA8JOZ3KEd+LU48annxCcSINyFLSl8560Mgx5avXE5eCB40RprS1AgfL RBoy/To5OxWYq+vEGSXg =eltL -----END PGP SIGNATURE-----
Current thread:
- CVE Request: Squid HTTP Proxy Denial of Service Amos Jeffries (Sep 17)
- <Possible follow-ups>
- CVE Request: Squid HTTP Proxy Denial of Service Amos Jeffries (Sep 17)
- CVE Request: Squid HTTP Proxy Denial of Service Amos Jeffries (Sep 17)