oss-sec mailing list archives
Re: Squid HTTP proxy CVE request
From: Reed Black <reed () unsafeword org>
Date: Thu, 9 Jul 2015 13:47:55 -0700
As I read this, issue #1 allows CONNECT requests to proceed that shouldn't otherwise. Is unsetting AllowTcpForwarding also sufficient for the "Determining if your version is vulnerable" section? On Mon, Jul 6, 2015 at 4:26 AM, Amos Jeffries <squid3 () treenet co nz> wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, This months release of Squid HTTP proxy, version 3.5.6, contains fixes for two security issues. Issue #1: Due to incorrect handling of peer responses in a hierarchy of 2 or more proxies remote clients (or scripts run on a client) are able to gain unrestricted access through a gateway proxy to its backend proxy. If the two proxies have differing levels of security this could lead to authentication bypass or unprivileged access to supposedly secure resources. <http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.p atch> All Squid up to and including 3.5.5 are vulnerable. (when published the advisory for this will be <http://www.squid-cache.org/Advisories/SQUID-2015_2.txt>) Issue #2: This is somewhat more obscure, and I am seeking clarification perhapse more than assignment. Squid up to and including 3.5.5 are apparently vulnerable to DoS attack from malicious clients using repeated TLS renegotiation messages. This has not been verified as it also seems to require outdated (0.9.8l and older) OpenSSL libraries. <http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13849.p atch> CVE-2009-3555 was mentioned by the submitter, but that was clearly assigned for server-initiated renegotiation. This Squid change is specifically for the client-initiated renegotiation part of the TLS protocol flaw. There may be some relevant CVE already assigned, although I've been unable to find it. Only CVE-2011-1473 which is for the library itself and disputed. So, is server software being assigned specific CVE (or a shared generic one) for resolving this flaw? Please indicate which CVE Squid announcements should mention (if any). Thanks, Amos Jeffries Squid Software Foundation -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQIcBAEBAgAGBQJVmmXyAAoJEGvSOzfXE+nLLjMP/2qTXQODFIdE9zfL3ZQ8MRhZ Edh4PNFxSkhvVyYn8kU6ZMg2jx7hiXXEfiP/Ilvo3XcY/eDWf64g+POgLX20X5jV o/StXDKHvcZUargImliJb2W1nalIGw1iqBERs6qwfRJhK67MHPgGWwxHu/SFEWsM Kk2GRlGlIM4H8g7FnsDvwAnAYweGm3+iSqZlQEaX5JOqem2M8qukGziQsc28yU4E SU5YIwNltW563pQYD+UTerz5i24Dt086in1AvSEFiLfqAMq4o3AdcFK73RhBdKyY yJJ0rKaz3o18vtru3I7soms8dmUI0mLxX6imPrBHOeSInjGbbRvPIU3g2WYpcdwF o6/7Xbg8HB+9QORXINqzC02aBiIJf8blleBnUKJQt1JMhQkb8vXAW4wcHoKfKTPo w9gyhwHgbBCYk0gSQ5CuIlaqPUEPAST0DiV0OIDHltjeLSq7vsq5zij9OKLxQdDJ nemVr03jrPHELCvV6eKXT/UJj6X+vfpCJk+giQq6rXC8ikhTvpID1aU/xOGxNJGq ig9ThwADl6RE2/cgjh7bnz1IPcG679V85uMbwPVTXU38XmhTyWQKjDdt5DuAdd6a RUsheekgzf5Lhhcv7/wht/ecNxDbBKvW8o8fvMinn5j9c0GNSNXtGbp8QYlySFS9 ycdNaJLFdIm8LnV5rNSW =COJ4 -----END PGP SIGNATURE-----
Current thread:
- Squid HTTP proxy CVE request Amos Jeffries (Jul 06)
- Re: Squid HTTP proxy CVE request Amos Jeffries (Jul 08)
- Re: Squid HTTP proxy CVE request Reed Black (Jul 09)
- Re: Squid HTTP proxy CVE request Amos Jeffries (Jul 09)
- Re: Squid HTTP proxy CVE request Amos Jeffries (Jul 14)
- Re: Squid HTTP proxy CVE request Mark Felder (Jul 17)
- Re: Squid HTTP proxy CVE request cve-assign (Jul 17)
- Re: Re: Squid HTTP proxy CVE request Amos Jeffries (Jul 17)
- Re: Squid HTTP proxy CVE request cve-assign (Jul 17)