CERT-In Vulnerability Note
CIVN-2004-0060
Vulnerability in Squid Web Proxy Cache
Original Issue Date:October 18, 2004
Severity Rating: HIGH
Systems Affected
- Squid Web Proxy Cache Version 2.5-STABLE5 compiled with SNMP support.
According to iDefense security advisory, Squid Web Proxy Cache Version 3.0-PRE3-20040702 is also affected.
Overview
A malformed SNMP request sent by a malicious user to an affected Squid Web Proxy will cause it to restart and lead to Denial of Service.
Impact
Denial of Service.
Description
A design error exists in the SNMP module of Squid Web Proxy Cache which allows certain header length combinations to pass validations instead of being blocked. This causes a Page Segmentation Fault in the Squid Web Proxy causing it to restart. The malicious user will need to send only a single UDP packet to exploit this vulnerability.
The design error is specifically located in the asn_parse_header procedure of snmplib/asn1.c.
Workaround
If the binary is built with SNMP support, temporarily disable the SNMP support by adding snmp_port 0 into squid.conf Use filtering to allow only SNMP data from trusted hosts.
Solution
Apply the relevant patch available from
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE6-SNMP_core_dump.patch
Vendor Information
Squid Web Proxy Cache
http://www.squid-cache.org/
References
Squid Web Proxy Advisory
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump
iDefense Vulnerability Note
http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities
CVE Name
CAN-2004-0918
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|