Advisory -------- Date 2009-10-26 Program squidGuard URL http://squidguard.org/ Found by Matthieu BOUTHORS Application description ------------------------ SquidGuard is a URL redirector used to use blacklists with the proxysoftware Squid. There are two big advantages to squidguard: it is fast and it is free. SquidGuard is published under GNU Public License. Vulnerability description ------------------------- Multiple buffer overflow can lead to filtering policy bypass and DoS. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2009-3700 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Vulnerability details ---------------------- The vulnerability is due to insecure buffer handling. For instance in sgLog.c : if(vsprintf(msg, format, ap) > (MAX_BUF - 1)) This piece of code may cause a buffer overflow and detects when it's too late. squidGuard only logs URL with patched bypass attempts (for instance, trailing dot or double dash, see http://www.squidguard.org/Doc/advisories.html). MAX_BUF is 4096, squid does not allow URL greater than 4096 characters. So in order to cause a buffer overflow, the attacker has to use an URL close to 4096 characters. A succesfull attackers would put squidGuard in emergency mode, in this mode squidGuard approve each requests. A less succesfull attacker can freeze the squidGuard instance, reproduct this attack can lead to a DoS. Systems affected ---------------- squidGuard 1.3 squidGuard 1.4 Solution -------- Two patches has been released by the squidGuard team : Patch-20091015 and Patch-20091019.