|
Squid HTTP Specifications Web Proxy Cache Poisoning
|
|
Secunia Advisory:
|
SA15093
|
|
|
Release Date:
|
2005-04-29
|
|
Last Update:
|
2005-05-03
|
|
Popularity:
|
13,144 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Manipulation of data
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Squid 2.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-1389
CVE-2005-1390
|
|
Description:
Steve Orrin has reported a vulnerability in Squid, which can be exploited by malicious people to poison the web proxy cache.
The vulnerability is caused due to an error in the handling of upstream HTTP agents (e.g. web servers) not complying correctly with the HTTP specifications. This can be exploited to cause the HTTP agent and Squid to be out-of-sync by sending a specially crafted request containing e.g. white spaces in the HTTP header names and extra CR characters at the end of HTTP headers.
Successful exploitation allows poisoning of the web proxy cache.
An issue, where input validation errors in dynamic web sites can be exploited to conduct HTTP response splitting attacks, has also been reported.
The vulnerability has been reported in versions 2.5.STABLE7 and prior.
Solution:
Update to version 2.5.STABLE8.
Apply patches for version 2.5.STABLE7:
http://www.squid-cache.org/Versions/v...quid-2.5.STABLE7-header_parsing.patch
http://www.squid-cache.org/Versions/v...-2.5.STABLE7-response_splitting.patch
http://www.squid-cache.org/Versions/v....STABLE7-oversize_reply_headers.patch
Disable HTTP persistent connections (see original advisory).
Provided and/or discovered by:
Steve Orrin, Watchfire.
Changelog:
2005-05-03: Added CVE references.
Original Advisory:
Squid:
http://www.squid-cache.org/Advisories/SQUID-2005_4.txt
http://www.squid-cache.org/Advisories/SQUID-2005_5.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
