(SCO Issues Fix) Squid Proxy Cache '%00' URL Character Access Control Bug May Let Remote Users Bypass Certain Access Controls
|
|
SecurityTracker Alert ID: 1011128
|
|
SecurityTracker URL: http://securitytracker.com/id?1011128
|
|
CVE Reference: CAN-2004-0189
(Links to External Site)
|
Date: Sep 1 2004
|
Impact: Host/resource access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): Squid-2.x up to and including 2.5.STABLE4
|
Description: A vulnerability was reported in the Squid Proxy Cache server in the processing of URLs containing '%00'. A remote user may be able to bypass certain access controls.
It is reported that a flaw in the '%xx' URL decoding function may allow a remote user to bypass access controls that use 'url_regex'
access control list (ACL) types. The report indicates that Squid will insert a NUL character in place of '%00' in a URL before
analyzing the URL for access control purposes. As a result, the 'http://foo%00@www.example.com/' URL will not be properly detected
as a URL to be denied in accordance with the following type of access control configuration:
acl BadSite url_regex www\.example\.com
http_access deny BadSite
In this example, Squid will attempt to compare 'http://foo' with 'www\.example\.com' and will not
find a match, so the URL will not be denied.
Mitch Adair is credited with reporting this flaw.
|
Impact: A remote user may be able to submit a specially crafted URL to bypass url_regex access controls.
|
Solution: SCO has issued a fix, described at:
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.13
|
Vendor URL: www.squid-cache.org/Advisories/SQUID-2004_1.txt (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Caldera/SCO)
|
Underlying OS Comments: OpenServer 5.0.6, 5.0.7
|
Reported By: please_reply_to_security@sco.com
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 31 Aug 2004 13:10:39 -0700 (PDT)
From: please_reply_to_security@sco.com
Subject: OpenServer 5.0.6 OpenServer 5.0.7 : squid %-encoded characters in a URL
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: OpenServer 5.0.6 OpenServer 5.0.7 : squid %-encoded characters in a URL
Advisory number: SCOSA-2004.13
Issue date: 2004 August 31
Cross reference: sr890342 fz529456 erg712609 CAN-2004-0189
______________________________________________________________________________
1. Problem Description
The "%xx" URL decoding function in Squid 2.5STABLE4 and
earlier allows remote attackers to bypass url_regex ACLs
via a URL with a NULL ("%00") character, which causes Squid
to use only a portion of the requested URL when comparing
it against the access control lists.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0189 to this issue.
2. Vulnerable Supported Versions
System Binaries
----------------------------------------------------------------------
OpenServer 5.0.6 Squid distribution < 2.5.STABLE5
OpenServer 5.0.7 Squid distribution < 2.5.STABLE5
3. Solution
The proper solution is to install the latest packages.
4. OpenServer 5.0.6
4.1 First install oss646c or later
4.2 Location of oss646c
ftp://ftp.sco.com/pub/openserver5/oss646c/
4.3 Verification of oss646c
MD5 (VOL.000.000) = f19b6c6949f615316bfb075d249989e8
MD5 (VOL.000.001) = 341ff8553aecd2c7b0c2beaf83030d0f
MD5 (VOL.000.002) = 6e46708ad8029e12280d4f9ac60ab814
MD5 (VOL.000.003) = 2868b64a6a6db742adb3b485be645d7e
MD5 (VOL.000.004) = 1696fe1db9bb063827ee5e76e58dff84
MD5 (VOL.000.005) = f39da342f8af72fcaccdf478dca04109
MD5 (VOL.000.006) = 2b31611c8af7d2e7910d6e8e3cf701a6
MD5 (VOL.000.007) = d0175c0f4e3ed29435b1eab95609f8f4
MD5 (VOL.000.008) = aa9e8a525c341fed077f981b1dacb486
MD5 (VOL.000.009) = 8e023af67b57507824406bdda322079a
MD5 (VOL.000.010) = 2b46e8adba8ae0b64109f2069da978a2
4.4 Installation of oss646c
See ftp://ftp.sco.com/pub/openserver5/oss646c/oss646c.txt
4.5 Next install xorg-6.7.0Ba or later
4.6 Location of xorg-6.7.0Ba
ftp://ftp.sco.com/pub/openserver5/opensrc/xorg-6.7.0Ba/
4.7 Verification of xorg-6.7.0Ba
MD5 (VOL.000.000) = 289d1070c4135e4d25a20501dbca08d8
MD5 (VOL.000.001) = 4111dadf961d4ef88e89112070f3e811
MD5 (VOL.000.002) = 4c4cdf4bf4c28045b7b323cfa407829f
MD5 (VOL.000.003) = d7e8da318d1c4df6fff14f60d993cf45
MD5 (VOL.000.004) = bfc0571f1fededd1780fafa76db9be90
4.8 Installation of xorg-6.7.0Ba
See ftp://ftp.sco.com/pub/openserver5/opensrc/xorg-6.7.0Ba/xorg67_rn.txt
4.9 Next install gwxlibs-1.3.3Db or later
4.10 Location of gwxlibs-1.3.3Db
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10
4.11 Verification
MD5 (VOL.000.000) = a85cf35c417903522392064aaa98f0a4
MD5 (VOL.000.001) = d4383d6bc74bb6e873e7a4c8dfdc4e6b
MD5 (VOL.000.002) = c5657b1358ef96177ae15fdcfec7132f
MD5 (VOL.000.003) = 4c88ceb3502330b4c4d5e07ca7fc5214
4.12 Installation of gwxlibs-1.3.3Db
See ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt
4.13 Next install perl-5.8.4Aa or later
4.14 Location of perl-5.8.4Aa
ftp://ftp.sco.com/pub/openserver5/opensrc/perl-5.8.4Aa/
4.15 Verification
MD5 (VOL.000.000) = b83b5e0ae513a1cb206baf37c4741653
MD5 (VOL.000.001) = 1ab35276079e7661e38b72047cec488a
MD5 (VOL.000.002) = 64a76371eae54e95d0b7e99be25f0a8a
MD5 (VOL.000.003) = 724521beddc740ae4958fd63d1c45f3f
MD5 (VOL.000.004) = f1d631477f16ce7b9512fbe60d9e3d0e
4.16 Installation of perl-5.8.4Aa
See ftp://ftp.sco.com/pub/openserver5/opensrc/perl-5.8.4Aa/perl584_rn.txt
4.17 Location of Squid Fixed Binaries
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.13
4.18 Verification
MD5 (VOL.000.000) = 656d0097b861d9e2375f672579e15c6b
MD5 (VOL.000.001) = 4f15cb68083fb6ceff3dd3c72aed41a2
MD5 (VOL.000.002) = 6fbf1b23e9d86f621de916bca4e476b3
MD5 (VOL.000.003) = fefcfc2f2d4f56e8be34d917a882bd41
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
4.19 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
1) Download the VOL* files to a directory.
2) Run the custom command, specify an install from media
images, and specify the directory as the location of
the images.
5. OpenServer 5.0.7
5.1 Location of Fixed Binaries
Supplement CD 3
http://www.sco.com/support/update/download/osr507list.html
5.2 Verification
MD5 (osr507suppcd3.iso) = 129229594bd3a020db429e7de8b95def
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
5.3 Installing Fixed Binaries
See the Supplement CD 3 Release Notes
ftp://ftp.sco.com/pub/openserver5/507/iso/suppcd3/osr507suppcd3.txt
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0189
http://xforce.iss.net/xforce/xfdb/15366
SCO security resources:
http://www.sco.com/support/security/index.html
SCO security advisories via email
http://www.sco.com/support/forums/security.html
This security fix closes SCO incidents sr890342 fz529456
erg712609.
7. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers
intended to promote secure installation and use of SCO
products.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFBNL0XaqoBO7ipriERAmv9AJ9Wi6ZZEip3tVjqhZNnBHW1Zmm/bgCcDfsW
nt+fu8szCDyGIEtJEpD1Kmg=
=B+qM
-----END PGP SIGNATURE-----
|
|
