Squid: Multiple Denial of Service vulnerabilities

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200701-22 / squid
Release Date	January 25, 2007
Latest Revision	January 25, 2007: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-proxy/squid	< 2.6.7	>= 2.6.7	All supported architectures

Related bugreports: #162364

Synopsis

Two vulnerabilities have been found in Squid which make it susceptible to Denial of Service attacks.

2. Impact Information

Background

Squid is a multi-protocol proxy server.

Description

Squid fails to correctly handle ftp:// URI's. There is also an error in the external_acl queue which can cause an infinite looping condition.

Impact

An attacker could attempt to retrieve a specially crafted URI via a Squid server causing the service to crash. If an attacker could generate a sufficiently high load on the Squid services, they could cause a Denial of Service by forcing Squid into an infinite loop.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Squid users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-proxy/squid-2.6.7"

4. References

Updated January 25, 2007

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.