Skip to Content.
Sympa Menu

sm-security - [SM-Security] squid: authentication handling

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] squid: authentication handling
  • Date: Sun, 13 Nov 2005 23:52:29 +0100

Synopsis
========
Squid, while performing NTLM authentication, does not properly handle
certain request sequences.

Background
==========
Squid is...
* a full-featured Web proxy cache
* designed to run on Unix systems
* free, open-source software
* the result of many contributions by unpaid (and paid) volunteers

Description
===========
CAN-2005-2917:
Squid, while performing NTLM authentication, does not properly handle
certain request sequences, which allows attackers to cause a denial of
service (daemon restart).

Impact
======
Upstream developers of squid, the popular WWW proxy cache, have
discovered that changes in the authentication scheme are not handled
properly when given certain request sequences while NTLM authentication
is in place, which may cause the daemon to restart.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All squid users should upgrade to the latest available version:
# scribe update
# cast -c squid

References
==========
[ 1 ] CAN-2005-2917
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2917

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36


Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] squid: authentication handling, Thomas Houssin, 11/13/2005

Archive powered by MHonArc 2.6.24.

Top of Page