Steve Orrin has reported a vulnerability in Squid, which can be exploited by malicious people to poison the web proxy cache.

The vulnerability is caused due to an error in the handling of upstream HTTP agents (e.g. web servers) not complying correctly with the HTTP specifications. This can be exploited to cause the HTTP agent and Squid to be out-of-sync by sending a specially crafted request containing e.g. white spaces in the HTTP header names and extra CR characters at the end of HTTP headers.

Successful exploitation allows poisoning of the web proxy cache.

An issue, where input validation errors in dynamic web sites can be exploited to conduct HTTP response splitting attacks, has also been reported.

The vulnerability has been reported in versions 2.5.STABLE7 and prior.

Solution
Update to version 2.5.STABLE8.
Further details available in Customer Area

Provided and/or discovered by
Steve Orrin, Watchfire.

Changelog
Further details available in Customer Area

Original Advisory
Squid:
http://www.squid-cache.org/Advisories/SQUID-2005_4.txt
http://www.squid-cache.org/Advisories/SQUID-2005_5.txt

Deep Links
Links available in Customer Area