 Steve Orrin has reported a vulnerability in Squid, which can be exploited by malicious people to poison the web proxy cache.
The vulnerability is caused due to an error in the handling of upstream HTTP agents (e.g. web servers) not complying correctly with the HTTP specifications. This can be exploited to cause the HTTP agent and Squid to be out-of-sync by sending a specially crafted request containing e.g. white spaces in the HTTP header names and extra CR characters at the end of HTTP headers.
Successful exploitation allows poisoning of the web proxy cache.
An issue, where input validation errors in dynamic web sites can be exploited to conduct HTTP response splitting attacks, has also been reported.
The vulnerability has been reported in versions 2.5.STABLE7 and prior.
SOFTWARE:
Squid 2.x
SOLUTION:
Update to version 2.5.STABLE8.
Apply patches for version 2.5.STABLE7:
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-header_parsing.patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-response_splitting.patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch
Disable HTTP persistent connections (see original advisory).
PROVIDED AND/OR DISCOVERED BY:
Steve Orrin, Watchfire.
ORIGINAL ADVISORY:
Squid:
http://www.squid-cache.org/Advisories/SQUID-2005_4.txt
http://www.squid-cache.org/Advisories/SQUID-2005_5.txt
VERIFY ADVISORY:
http://secunia.com/advisories/15093/
Secunia Security Advisories
| 
Contribute :
Advanced Search :
Web Resources :
Polls :
File Repository
