3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
145 lines
5.2 KiB
Text
145 lines
5.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:12 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: multiple security vulnerabilities in squid port
|
|
|
|
Category: ports
|
|
Module: squid24
|
|
Announced: 2002-02-21
|
|
Credits: Jouko Pynnonen <jouko@solutions.fi>
|
|
Henrik Nordstrom <hno@squid-cache.org>
|
|
Affects: Ports collection prior to the correction date
|
|
Corrected: 2002-02-19 13:46:22 UTC
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
The Squid Internet Object Cache is a web proxy/cache.
|
|
|
|
II. Problem Description
|
|
|
|
The following security vulnerabilities are known to exist in versions
|
|
of Squid prior to 2.4-STABLE4 (port version 2.4_8):
|
|
|
|
1) The optional SNMP monitoring interface suffers from a memory leak.
|
|
The FreeBSD port does not normally include this code, but it can be
|
|
enabled with a compile-time option.
|
|
|
|
2) A buffer overflow exists in the code charged with parsing the
|
|
authentication portion of FTP URLs.
|
|
|
|
3) The optional HTCP interface can not be properly disabled at
|
|
run-time. The FreeBSD port does not normally include this code, but
|
|
it can be enabled with a compile-time option.
|
|
|
|
The squid port is not installed by default, nor is it "part of
|
|
FreeBSD" as such: it is part of the FreeBSD ports collection, which
|
|
contains thousands of third-party applications in a ready-to-install
|
|
format. The ports collection shipped with FreeBSD 4.5 contains this
|
|
problem since it was discovered after the release.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security
|
|
audit of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
1) An attacker with the ability to send packets to the Squid SNMP port
|
|
can cause Squid to run out of memory and crash. (NOTE: The FreeBSD
|
|
port does not have SNMP enabled by default.)
|
|
|
|
2) An authorized user of the squid proxy may submit a specially
|
|
crafted ftp:// request in order to crash the squid process, causing a
|
|
denial of service. It may also be possible to cause the execution of
|
|
arbitrary code with the privilege level of the squid process, although
|
|
no such exploits are known to exist at this time.
|
|
|
|
3) Unauthorized users may utilize cache resources by using HTCP.
|
|
(NOTE: The FreeBSD port does not have HTCP enabled by default.)
|
|
|
|
IV. Workaround
|
|
|
|
1) As regards the SNMP issue, the following configuration statement
|
|
will disable the SNMP support altogether:
|
|
|
|
snmp_port 0
|
|
|
|
2) Optionally, set up a firewall rule to block incoming packets to the
|
|
Squid SNMP port (normally, UDP port 3401) from untrusted hosts.
|
|
|
|
3) For the second vulnerability, deny forwarding of non-anonymous FTP
|
|
URLs by inserting the following rules at the top of squid.conf, prior
|
|
to any http_access allow lines:
|
|
|
|
acl non_anonymous_ftp url_regex -i ftp://[^/@]*@
|
|
http_access deny non_anonymous_ftp
|
|
|
|
4) No workaround exists for the HTCP issue except to set up a firewall
|
|
rule to block incoming packets to the Squid HTCP port (normally, UDP
|
|
port 4827) from untrusted hosts.
|
|
|
|
5) Alternatively, deinstall the squid port/package.
|
|
|
|
V. Solution
|
|
|
|
Do one of the following:
|
|
|
|
1) Upgrade your entire ports collection and rebuild the port.
|
|
|
|
2) Deinstall the old package and install a new package dated after the
|
|
correction date, obtained from the following directories:
|
|
|
|
[i386]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/
|
|
squid-2.4_8.tgz
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/
|
|
squid-2.4_8.tgz
|
|
|
|
[alpha]
|
|
Packages are not automatically generated for the alpha architecture at
|
|
this time due to lack of build resources.
|
|
|
|
NOTE: It may be several days before updated packages are available.
|
|
|
|
3) Download a new port skeleton for the squid port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/Latest/portcheckout.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/Latest/portcheckout.tgz
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in the FreeBSD ports collection.
|
|
|
|
Path Revision
|
|
- -------------------------------------------------------------------------
|
|
ports/www/squid24/Makefile 1.87
|
|
ports/www/squid24/distinfo 1.63
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.squid-cache.org/Versions/v2/2.4/bugs/>
|
|
<URL:http://www.squid-cache.org/Advisories/SQUID-2002_1.txt>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBPHT5kVUuHi5z0oilAQFGvwQAj+u0n0OOsV7hxxkMEgCBaZg/LBJWmOkR
|
|
FwOCxy27eSgSdEqoZcNpZlPM+aFUf6r9bWbg5+S66R+kLb7cMOblgZX69YoU6kn7
|
|
QedUoHyBWYuoNd5pBG1VJmyW4NZrQ4vPOM7bdfddSNxt1YpW5P0NNjPaTTmBe96E
|
|
tZg1bT4hXhM=
|
|
=N1OC
|
|
-----END PGP SIGNATURE-----
|