[squid-users] [ADVISORY] SQUID-2012:1 Denial of Service Vulnerability in cachemgr.cgi

__________________________________________________________________

     Squid Proxy Cache Security Update Advisory SQUID-2012:1
__________________________________________________________________

Advisory ID: SQUID-2012:1
Date: December 17, 2012
Summary: Denial of service in cachemgr.cgi
Affected versions: Squid 2.x all releases
                         Squid 3.0 all releases
                         Squid 3.1 -> 3.1.21
                         Squid 3.2 -> 3.2.3
                         Squid 3.3.0.1
Fixed in version: Squid 3.3.0.2, 3.2.4, 3.1.22
__________________________________________________________________

     http://www.squid-cache.org/Advisories/SQUID-2012_1.txt
__________________________________________________________________

Problem Description:

  Due to missing input validation Squid cachemgr.cgi tool is
  vulnerable to a denial of service attack when processing
  specially crafted requests.

__________________________________________________________________

Severity:

  This problem allows any client able to reach the cachemgr.cgi
  to perform a denial of service attack on the service host.

  The nature of the attack may cause secondary effects through
  resource consumption on the host server.

__________________________________________________________________

Updated Packages:

  This bug is fixed by Squid versions 3.2.4 and 3.3.0.2

  In addition, patches addressing this problem for stable releases
  can be found in our patch archives:

Squid 3.1:
http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch

Squid 3.2:
http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch

  If you are using a prepackaged version of Squid then please refer
  to the package vendor for availability information on updated
  packages.

__________________________________________________________________

Determining if your version is vulnerable:

  Squid proxy is not vulnerable. The problem is isolated to the
  manager CGI interface tool.

  cachemgr.cgi tool displays its version number in the HTML pages
  with a version number:

   All 2.x versions up to and including 2.7.STABLE9 are vulnerable.

   All 3.x versions up to and including 3.1.21 are vulnerable.

   All 3.2 versions up to and including 3.2.3 are vulnerable.

   The 3.3.0.1 beta version is vulnerable

   All 3.x versions newer than the above are not vulnerable.

__________________________________________________________________

Workaround:

  Add access controls to the host web server limiting which clients
  can send requests to the CGI tool.

or,

  Add server limits to CGI process memory consumption to the
  host web server running cachemgr.cgi.

__________________________________________________________________

Contact details for the Squid project:

  For installation / upgrade support on binary packaged versions
  of Squid: Your first point of contact should be your binary
  package vendor.

  If you install and build Squid from the original Squid sources
  then thesquid-users_at_squid-cache.org mailing list is your primary
  support point. For subscription details see
  http://www.squid-cache.org/Support/mailing-lists.html.

  For reporting of non-security bugs in the latest release
  the squid bugzilla database should be used
  http://bugs.squid-cache.org/.

  For reporting of security sensitive bugs send an email to the
  squid-bugs_at_squid-cache.org mailing list. It's a closed list
  (though anyone can post) and security related bug reports are
  treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

  The vulnerability was discovered by Coverity Scan Project.

__________________________________________________________________

Revision history:

  2012-10-29 12:47 --- Initial Detection
  2012-11-15 03:05 GMT Patches Released
  2012-12-17 06:20 GMT Advisory Released
__________________________________________________________________
END
Received on Mon Dec 17 2012 - 06:45:23 MST