squidGuard 1.3 & 1.4 : buffer overflow

2009-10-29 / 2009-10-30
Credit: majinboo
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-119

Advisory -------- Date 2009-10-26 Program squidGuard URL http://squidguard.org/ Found by Matthieu BOUTHORS Application description ------------------------ SquidGuard is a URL redirector used to use blacklists with the proxysoftware Squid. There are two big advantages to squidguard: it is fast and it is free. SquidGuard is published under GNU Public License. Vulnerability description ------------------------- Multiple buffer overflow can lead to filtering policy bypass and DoS. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2009-3700 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Vulnerability details ---------------------- The vulnerability is due to insecure buffer handling. For instance in sgLog.c : if(vsprintf(msg, format, ap) > (MAX_BUF - 1)) This piece of code may cause a buffer overflow and detects when it's too late. squidGuard only logs URL with patched bypass attempts (for instance, trailing dot or double dash, see http://www.squidguard.org/Doc/advisories.html). MAX_BUF is 4096, squid does not allow URL greater than 4096 characters. So in order to cause a buffer overflow, the attacker has to use an URL close to 4096 characters. A succesfull attackers would put squidGuard in emergency mode, in this mode squidGuard approve each requests. A less succesfull attacker can freeze the squidGuard instance, reproduct this attack can lead to a DoS. Systems affected ---------------- squidGuard 1.3 squidGuard 1.4 Solution -------- Two patches has been released by the squidGuard team : Patch-20091015 and Patch-20091019.

Referencje:

http://www.vupen.com/english/advisories/2009/3013
http://www.securityfocus.com/bid/36800
http://xforce.iss.net/xforce/xfdb/53922
http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019
http://www.securityfocus.com/archive/1/archive/1/507440/100/0/threaded
http://www.osvdb.org/59164
http://securitytracker.com/id?1023079
http://secunia.com/advisories/37107


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top