(Gentoo Issues Fix) Squid Proxy Cache '%00' URL Character Access Control Bug May Let Remote Users Bypass Certain Access Controls
|
|
SecurityTracker Alert ID: 1009625
|
|
CVE Reference: CAN-2004-0189
(Links to External Site)
|
Date: Apr 1 2004
|
Impact: Host/resource access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): Squid-2.x up to and including 2.5.STABLE4
|
Description: A vulnerability was reported in the Squid Proxy Cache server in the processing of URLs containing '%00'. A remote user may be able to bypass certain access controls.
It is reported that a flaw in the '%xx' URL decoding function may allow a remote user to bypass access controls that use 'url_regex'
access control list (ACL) types. The report indicates that Squid will insert a NUL character in place of '%00' in a URL before
analyzing the URL for access control purposes. As a result, the 'http://foo%00@www.example.com/' URL will not be properly detected
as a URL to be denied in accordance with the following type of access control configuration:
acl BadSite url_regex www\.example\.com
http_access deny BadSite
In this example, Squid will attempt to compare 'http://foo' with 'www\.example\.com' and will not
find a match, so the URL will not be denied.
Mitch Adair is credited with reporting this flaw.
|
Impact: A remote user may be able to submit a specially crafted URL to bypass url_regex access controls.
|
Solution: Gentoo has released a fix with the following upgrade instructions:
# emerge sync
# emerge -pv ">=net-www/squid-2.5.5"
# emerge ">=net-www/squid-2.5.5"
|
Vendor URL: www.squid-cache.org/Advisories/SQUID-2004_1.txt (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Gentoo)
|
Reported By: Kurt Lieber <klieber@gentoo.org>
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 31 Mar 2004 03:49:04 -0500
From: Kurt Lieber <klieber@gentoo.org>
Subject: [gentoo-announce] [ GLSA 200403-11 ] Squid ACL [url_regex] bypass vulnerability
|
--dQ2UWBmeJhPxzxhA
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200403-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Squid ACL [url_regex] bypass vulnerability
Date: March 30, 2004
Bugs: #45273
ID: 200403-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Squid versions 2.0 through to 2.5.STABLE4 could allow a remote attacker
to bypass Access Control Lists by sending a specially-crafted URL
request containing '%00': in such circumstances; the url_regex ACL may
not properly detect the malicious URL, allowing the attacker to
effectively bypass the ACL.
Background
==========
Squid is a fully-featured Web Proxy Cache designed to run on Unix
systems that supports proxying and caching of HTTP, FTP, and other
URLs, as well as SSL support, cache hierarchies, transparent caching,
access control lists and many other features.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
net-www/squid < 2.5.5 >= 2.5.5
Description
===========
A bug in Squid allows users to bypass certain access controls by
passing a URL containing "%00" which exploits the Squid decoding
function. This may insert a NUL character into decoded URLs, which may
allow users to bypass url_regex access control lists that are enforced
upon them.
In such a scenario, Squid will insert a NUL character after the"%00"
and it will make a comparison between the URL to the end of the NUL
character rather than the contents after it: the comparison does not
result in a match, and the user's request is not denied.
Impact
======
Restricted users may be able to bypass url_regex access control lists
that are enforced upon them which may cause unwanted network traffic as
well as a route for other possible exploits. Users of Squid 2.5STABLE4
and below who require the url_regex features are recommended to upgrade
to 2.5STABLE5 to maintain the security of their infrastructure.
Workaround
==========
A workaround is not currently known for this issue. All users are
advised to upgrade to the latest version of Squid.
Resolution
==========
Squid can be updated as follows:
# emerge sync
# emerge -pv ">=net-www/squid-2.5.5"
# emerge ">=net-www/squid-2.5.5"
References
==========
[ 1 ] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0189
[ 2 ] http://www.squid-cache.org/Advisories/SQUID-2004_1.txt
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
--dQ2UWBmeJhPxzxhA
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFAaoYAJPpRNiftIEYRAnrWAJ952f5aZ2xGx85Jfhl1Q+f9AiaNLwCgiNPC
mik5Rj2mboFtFCAw5maofgE=
=Lr56
-----END PGP SIGNATURE-----
--dQ2UWBmeJhPxzxhA--
|
|
