Vulnerabilities > CVE-2005-0173 - Authentication Bypass vulnerability in Squid Proxy squid_ldap_auth

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
squid
nessus

Summary

squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-060.NASL
    descriptionAn updated Squid package that fixes several security issues is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Squid is a full-featured Web proxy cache. A buffer overflow flaw was found in the Gopher relay parser. This bug could allow a remote Gopher server to crash the Squid proxy that reads data from it. Although Gopher servers are now quite rare, a malicious webpage (for example) could redirect or contain a frame pointing to an attacker
    last seen2020-06-01
    modified2020-06-02
    plugin id17176
    published2005-02-22
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17176
    titleRHEL 4 : squid (RHSA-2005:060)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:060. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(17176);
      script_version ("1.22");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2005-0094", "CVE-2005-0095", "CVE-2005-0096", "CVE-2005-0097", "CVE-2005-0173", "CVE-2005-0174", "CVE-2005-0175", "CVE-2005-0211", "CVE-2005-0241");
      script_xref(name:"RHSA", value:"2005:060");
    
      script_name(english:"RHEL 4 : squid (RHSA-2005:060)");
      script_summary(english:"Checks the rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Squid package that fixes several security issues is now
    available.
    
    This update has been rated as having important security impact by the
    Red Hat Security Response Team.
    
    Squid is a full-featured Web proxy cache.
    
    A buffer overflow flaw was found in the Gopher relay parser. This bug
    could allow a remote Gopher server to crash the Squid proxy that reads
    data from it. Although Gopher servers are now quite rare, a malicious
    webpage (for example) could redirect or contain a frame pointing to an
    attacker's malicious gopher server. The Common Vulnerabilities and
    Exposures project (cve.mitre.org) has assigned the name CVE-2005-0094
    to this issue.
    
    An integer overflow flaw was found in the WCCP message parser. It is
    possible to crash the Squid server if an attacker is able to send a
    malformed WCCP message with a spoofed source address matching Squid's
    'home router'. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CVE-2005-0095 to this issue.
    
    A memory leak was found in the NTLM fakeauth_auth helper. It is
    possible that an attacker could place the Squid server under high
    load, causing the NTML fakeauth_auth helper to consume a large amount
    of memory, resulting in a denial of service. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0096 to this issue.
    
    A NULL pointer de-reference bug was found in the NTLM fakeauth_auth
    helper. It is possible for an attacker to send a malformed NTLM type 3
    message, causing the Squid server to crash. The Common Vulnerabilities
    and Exposures project (cve.mitre.org) has assigned the name
    CVE-2005-0097 to this issue.
    
    A username validation bug was found in squid_ldap_auth. It is possible
    for a username to be padded with spaces, which could allow a user to
    bypass explicit access control rules or confuse accounting. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0173 to this issue.
    
    The way Squid handles HTTP responses was found to need strengthening.
    It is possible that a malicious Web server could send a series of HTTP
    responses in such a way that the Squid cache could be poisoned,
    presenting users with incorrect webpages. The Common Vulnerabilities
    and Exposures project (cve.mitre.org) has assigned the names
    CVE-2005-0174 and CVE-2005-0175 to these issues.
    
    A bug was found in the way Squid handled oversized HTTP response
    headers. It is possible that a malicious Web server could send a
    specially crafted HTTP header which could cause the Squid cache to be
    poisoned, presenting users with incorrect webpages. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0241 to this issue.
    
    A buffer overflow bug was found in the WCCP message parser. It is
    possible that an attacker could send a malformed WCCP message which
    could crash the Squid server or execute arbitrary code. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0211 to this issue.
    
    Users of Squid should upgrade to this updated package, which contains
    backported patches, and is not vulnerable to these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0094"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0095"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0096"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0097"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0173"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0174"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0175"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0211"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0241"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_1.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_2.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_3.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Versions/v2/2.5/bugs/#"
      );
      # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?96864d1c"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2005:060"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected squid package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:squid");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/02/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/02/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 4.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2005:060";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL4", reference:"squid-2.5.STABLE6-3.4E.3")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "squid");
      }
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-061.NASL
    descriptionAn updated Squid package that fixes several security issues is now available. Squid is a full-featured Web proxy cache. A buffer overflow flaw was found in the Gopher relay parser. This bug could allow a remote Gopher server to crash the Squid proxy that reads data from it. Although Gopher servers are now quite rare, a malicious web page (for example) could redirect or contain a frame pointing to an attacker
    last seen2020-06-01
    modified2020-06-02
    plugin id16384
    published2005-02-14
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/16384
    titleRHEL 2.1 / 3 : squid (RHSA-2005:061)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:061. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(16384);
      script_version ("1.24");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2005-0094", "CVE-2005-0095", "CVE-2005-0096", "CVE-2005-0097", "CVE-2005-0173", "CVE-2005-0174", "CVE-2005-0175", "CVE-2005-0211", "CVE-2005-0241");
      script_bugtraq_id(12276);
      script_xref(name:"RHSA", value:"2005:061");
    
      script_name(english:"RHEL 2.1 / 3 : squid (RHSA-2005:061)");
      script_summary(english:"Checks the rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Squid package that fixes several security issues is now
    available.
    
    Squid is a full-featured Web proxy cache.
    
    A buffer overflow flaw was found in the Gopher relay parser. This bug
    could allow a remote Gopher server to crash the Squid proxy that reads
    data from it. Although Gopher servers are now quite rare, a malicious
    web page (for example) could redirect or contain a frame pointing to
    an attacker's malicious gopher server. The Common Vulnerabilities and
    Exposures project (cve.mitre.org) has assigned the name CVE-2005-0094
    to this issue.
    
    An integer overflow flaw was found in the WCCP message parser. It is
    possible to crash the Squid server if an attacker is able to send a
    malformed WCCP message with a spoofed source address matching Squid's
    'home router'. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CVE-2005-0095 to this issue.
    
    A memory leak was found in the NTLM fakeauth_auth helper. It is
    possible that an attacker could place the Squid server under high
    load, causing the NTML fakeauth_auth helper to consume a large amount
    of memory, resulting in a denial of service. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0096 to this issue.
    
    A NULL pointer de-reference bug was found in the NTLM fakeauth_auth
    helper. It is possible for an attacker to send a malformed NTLM type 3
    message, causing the Squid server to crash. The Common Vulnerabilities
    and Exposures project (cve.mitre.org) has assigned the name
    CVE-2005-0097 to this issue.
    
    A username validation bug was found in squid_ldap_auth. It is possible
    for a username to be padded with spaces, which could allow a user to
    bypass explicit access control rules or confuse accounting. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0173 to this issue.
    
    The way Squid handles HTTP responses was found to need strengthening.
    It is possible that a malicious web server could send a series of HTTP
    responses in such a way that the Squid cache could be poisoned,
    presenting users with incorrect webpages. The Common Vulnerabilities
    and Exposures project (cve.mitre.org) has assigned the names
    CVE-2005-0174 and CVE-2005-0175 to these issues.
    
    A bug was found in the way Squid handled oversized HTTP response
    headers. It is possible that a malicious web server could send a
    specially crafted HTTP header which could cause the Squid cache to be
    poisoned, presenting users with incorrect webpages. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0241 to this issue.
    
    A buffer overflow bug was found in the WCCP message parser. It is
    possible that an attacker could send a malformed WCCP message which
    could crash the Squid server or execute arbitrary code. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2005-0211 to this issue.
    
    Users of Squid should upgrade to this updated package, which contains
    backported patches, and is not vulnerable to these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0094"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0095"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0096"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0097"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0173"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0174"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0175"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0211"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0241"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_1.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_2.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_3.txt"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Versions/v2/2.5/bugs/#"
      );
      # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?96864d1c"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2005:061"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected squid package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:squid");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/02/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/02/14");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(2\.1|3)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1 / 3.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2005:061";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"squid-2.4.STABLE7-1.21as.4")) flag++;
    
      if (rpm_check(release:"RHEL3", reference:"squid-2.5.STABLE3-6.3E.7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "squid");
      }
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2005-034.NASL
    descriptionMore vulnerabilities were discovered in the squid server : The LDAP handling of search filters was inadequate which could be abused to allow logins using severial variants of a single login name, possibly bypassing explicit access controls (CVE-2005-0173). Minor problems in the HTTP header parsing code that could be used for cache poisoning (CVE-2005-0174 and CVE-2005-0175). A buffer overflow in the WCCP handling code allowed remote attackers to cause a Denial of Service and could potentially allow for the execution of arbitrary code by using a long WCCP packet. The updated packages have been patched to prevent these problems.
    last seen2020-06-01
    modified2020-06-02
    plugin id16377
    published2005-02-11
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16377
    titleMandrake Linux Security Advisory : squid (MDKSA-2005:034)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2005:034. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(16377);
      script_version ("1.17");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2005-0173", "CVE-2005-0174", "CVE-2005-0175", "CVE-2005-0211");
      script_xref(name:"MDKSA", value:"2005:034");
    
      script_name(english:"Mandrake Linux Security Advisory : squid (MDKSA-2005:034)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Mandrake Linux host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "More vulnerabilities were discovered in the squid server :
    
    The LDAP handling of search filters was inadequate which could be
    abused to allow logins using severial variants of a single login name,
    possibly bypassing explicit access controls (CVE-2005-0173).
    
    Minor problems in the HTTP header parsing code that could be used for
    cache poisoning (CVE-2005-0174 and CVE-2005-0175).
    
    A buffer overflow in the WCCP handling code allowed remote attackers
    to cause a Denial of Service and could potentially allow for the
    execution of arbitrary code by using a long WCCP packet.
    
    The updated packages have been patched to prevent these problems."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.squid-cache.org/Advisories/SQUID-2005_3.txt"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected squid package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:squid");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/02/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/02/11");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.0", reference:"squid-2.5.STABLE4-2.4.100mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK10.1", reference:"squid-2.5.STABLE6-2.3.101mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK9.2", reference:"squid-2.5.STABLE3-3.6.92mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-77-1.NASL
    descriptionA possible authentication bypass was discovered in the LDAP authentication backend. LDAP ignores leading and trailing whitespace in search filters. This could possibly be abused to bypass explicit access controls or confuse accounting when using several variants of the login name. (CAN-2005-0173) Previous Squid versions were not strict enough while parsing HTTP requests and responses. Various violations of the HTTP protocol, such as multiple Content-Length header lines, invalid
    last seen2020-06-01
    modified2020-06-02
    plugin id20699
    published2006-01-15
    reporterUbuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20699
    titleUbuntu 4.10 : squid vulnerabilities (USN-77-1)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-77-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(20699);
      script_version("1.14");
      script_cvs_date("Date: 2019/08/02 13:33:00");
    
      script_cve_id("CVE-2005-0173", "CVE-2005-0174", "CVE-2005-0175", "CVE-2005-0211");
      script_xref(name:"USN", value:"77-1");
    
      script_name(english:"Ubuntu 4.10 : squid vulnerabilities (USN-77-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A possible authentication bypass was discovered in the LDAP
    authentication backend. LDAP ignores leading and trailing whitespace
    in search filters. This could possibly be abused to bypass explicit
    access controls or confuse accounting when using several variants of
    the login name. (CAN-2005-0173)
    
    Previous Squid versions were not strict enough while parsing HTTP
    requests and responses. Various violations of the HTTP protocol, such
    as multiple Content-Length header lines, invalid 'Carriage Return'
    characters, and HTTP header names containing whitespace, led to cache
    pollution and could possibly be exploited to deliver wrong content to
    clients. (CAN-2005-0174)
    
    Squid was susceptible to a cache poisoning attack called 'HTTP
    response splitting', where false replies are injected in the HTTP
    stream. This allowed malicious web servers to forge wrong cache
    content for arbitrary websites, which was then delivered to Squid
    clients. (CAN-2005-0175)
    
    The FSC Vulnerability Research Team discovered a buffer overflow in
    the WCCP handling protocol. By sending an overly large WCCP packet, a
    remote attacker could crash the Squid server, and possibly even
    execute arbitrary code with the privileges of the 'proxy' user.
    (CAN-2005-0211).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:squid");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:squid-cgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:squid-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:squidclient");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:4.10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/02/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/01/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! ereg(pattern:"^(4\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 4.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"4.10", pkgname:"squid", pkgver:"2.5.5-6ubuntu0.4")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"squid-cgi", pkgver:"2.5.5-6ubuntu0.4")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"squid-common", pkgver:"2.5.5-6ubuntu0.4")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"squidclient", pkgver:"2.5.5-6ubuntu0.4")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "squid / squid-cgi / squid-common / squidclient");
    }
    
  • NASL familyFirewalls
    NASL idSQUID_WCCP_AND_GOPHER_FLAWS.NASL
    descriptionAccording to its version number, the remote Squid caching proxy is affected by several security flaws : - There is a buffer overflow when handling the reply of a rogue gopher site. (CVE-2005-0094) - There is a denial of service vulnerability in the WCCP code of the remote proxy. (CVE-2005-0095) - There is a buffer overflow in the WCCP code that may allow an attacker to execute arbitrary code on the remote host. (CVE-2005-0211) - There is a flaw in the
    last seen2020-06-01
    modified2020-06-02
    plugin id16190
    published2005-01-18
    reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16190
    titleSquid < 2.5.STABLE8 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
     script_id(16190);
     script_version("1.23");
     script_cvs_date("Date: 2018/07/30 15:31:32");
    
     script_cve_id("CVE-2005-0094", "CVE-2005-0095", "CVE-2005-0173", "CVE-2005-0174", "CVE-2005-0175", "CVE-2005-0211", "CVE-2005-0241");
     script_bugtraq_id(12275, 12276, 12412, 12433, 12432, 12431, 13434, 13435);
    
     script_name(english:"Squid < 2.5.STABLE8 Multiple Vulnerabilities");
     script_summary(english:"Determines squid version");
    
     script_set_attribute(attribute:"synopsis", value:"The remote proxy server is affected by multiple vulnerabilities.");
     script_set_attribute(attribute:"description", value:
    "According to its version number, the remote Squid caching proxy is
    affected by several security flaws :
    
      - There is a buffer overflow when handling the reply of a
        rogue gopher site. (CVE-2005-0094)
    
      - There is a denial of service vulnerability in the WCCP
        code of the remote proxy. (CVE-2005-0095)
    
      - There is a buffer overflow in the WCCP code that may
        allow an attacker to execute arbitrary code on the
        remote host. (CVE-2005-0211)
    
      - There is a flaw in the 'squid_ldap_auth' module that may
        allow an attacker to bypass authentication and to gain
        access to the remote proxy. (CVE-2005-0173)
    
      - There is a flaw in the way Squid parses HTTP reply
        headers. (CVE-2005-0241)
    
      - There is a weakness that may allow for cache poisoning
        via
        HTTP response splitting. (CVE-2005-0175)
    
      - There is a weakness that may allow for cache poisoning
        via
        crafted malformed headers. (CVE-2005-0174)
    
    Note that this may be a false-positive given the way the Squid team
    handles releases. Make sure that all the appropriate patches have been
    applied.");
     script_set_attribute(attribute:"see_also", value:"http://www.squid-cache.org/Versions/v2/2.5/bugs/");
     script_set_attribute(attribute:"solution", value:"Upgrade to Squid 2.5.STABLE8 or later.");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
     script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"false");
    
     script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/13");
     script_set_attribute(attribute:"plugin_publication_date", value:"2005/01/18");
    
     script_set_attribute(attribute:"potential_vulnerability", value:"true");
     script_set_attribute(attribute:"plugin_type", value:"remote");
     script_set_attribute(attribute:"cpe", value:"cpe:/a:squid-cache:squid");
     script_end_attributes();
    
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.");
     script_family(english:"Firewalls");
    
     script_dependencie("squid_version.nasl");
     script_require_keys("www/squid", "Settings/ParanoidReport");
     script_require_ports("Services/http_proxy", 3128, 8080);
    
     exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    # Build a list of ports from the
    list = get_kb_list("http_proxy/*/squid/version");
    if (isnull(list)) exit(0, "The host does not appear to be running a Squid proxy server.");
    
    vulnerable = FALSE;
    foreach item (keys(list))
    {
      port = ereg_replace(pattern:'^http_proxy/([0-9]+)/squid/version', replace:'\\1', string:item);
      version = list[item];
      source = get_kb_item('http_proxy/'+port+'/squid/source');
    
      if (
        version =~ '^2\\.[0-4]\\.' ||
        version =~ '^2\\.5\\.STABLE[0-7]([^0-9]|$)'
      )
      {
        vulnerable = TRUE;
        if (report_verbosity > 0)
        {
          report =
            '\n  Version source    : ' + source +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : 2.5.STABLE8' + '\n';
          security_hole(port:port, extra:report);
        }
        else security_hole(port:port);
      }
    }
    if (!vulnerable)
    {
      exit(0, "No vulnerable Squid installs were detected on the remote host.");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_7A921E9E68B111D99E1EC296AC722CB3.NASL
    descriptionThe LDAP authentication helper did not strip leading or trailing spaces from the login name. According to the squid patches page : LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access controls or confusing accounting. Workaround: Block logins with spaces acl login_with_spaces proxy_auth_regex [:space:] http_access deny login_with_spaces
    last seen2020-06-01
    modified2020-06-02
    plugin id18994
    published2005-07-13
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/18994
    titleFreeBSD : squid -- no sanity check of usernames in squid_ldap_auth (7a921e9e-68b1-11d9-9e1e-c296ac722cb3)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(18994);
      script_version("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:37");
    
      script_cve_id("CVE-2005-0173");
      script_xref(name:"CERT", value:"924198");
    
      script_name(english:"FreeBSD : squid -- no sanity check of usernames in squid_ldap_auth (7a921e9e-68b1-11d9-9e1e-c296ac722cb3)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The LDAP authentication helper did not strip leading or trailing
    spaces from the login name. According to the squid patches page :
    
    LDAP is very forgiving about spaces in search filters and this could
    be abused to log in using several variants of the login name, possibly
    bypassing explicit access controls or confusing accounting.
    
    Workaround: Block logins with spaces
    
    acl login_with_spaces proxy_auth_regex [:space:] http_access deny
    login_with_spaces"
      );
      # http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?96864d1c"
      );
      # http://www.squid-cache.org/bugs/show_bug.cgi?id=1187
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.squid-cache.org/show_bug.cgi?id=1187"
      );
      # https://vuxml.freebsd.org/freebsd/7a921e9e-68b1-11d9-9e1e-c296ac722cb3.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2e44454a"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:squid");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/01/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/07/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"squid<2.5.7_7")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200502-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200502-04 (Squid: Multiple vulnerabilities) Squid contains several vulnerabilities: Buffer overflow when handling WCCP recvfrom() (CAN-2005-0211). Loose checking of HTTP headers (CAN-2005-0173 and CAN-2005-0174). Incorrect handling of LDAP login names with spaces (CAN-2005-0175). Impact : An attacker could exploit: the WCCP buffer overflow to cause Denial of Service. the HTTP header parsing vulnerabilities to inject arbitrary response data, potentially leading to content spoofing, web cache poisoning and other cross-site scripting or HTTP response splitting attacks. the LDAP issue to login with several variations of the same login name, leading to log poisoning. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id16441
    published2005-02-14
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16441
    titleGLSA-200502-04 : Squid: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200502-04.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(16441);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:42");
    
      script_cve_id("CVE-2005-0173", "CVE-2005-0174", "CVE-2005-0175", "CVE-2005-0211");
      script_xref(name:"GLSA", value:"200502-04");
    
      script_name(english:"GLSA-200502-04 : Squid: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200502-04
    (Squid: Multiple vulnerabilities)
    
        Squid contains several vulnerabilities:
        Buffer overflow when handling WCCP recvfrom()
        (CAN-2005-0211).
        Loose checking of HTTP headers (CAN-2005-0173 and
        CAN-2005-0174).
        Incorrect handling of LDAP login names with spaces
        (CAN-2005-0175).
      
    Impact :
    
        An attacker could exploit:
        the WCCP buffer overflow to cause Denial of Service.
        the HTTP header parsing vulnerabilities to inject arbitrary
        response data, potentially leading to content spoofing, web cache
        poisoning and other cross-site scripting or HTTP response splitting
        attacks.
        the LDAP issue to login with several variations of the same login
        name, leading to log poisoning.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200502-04"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Squid users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=net-proxy/squid-2.5.7-r5'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:squid");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/02/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/02/14");
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/17");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-proxy/squid", unaffected:make_list("ge 2.5.7-r5"), vulnerable:make_list("lt 2.5.7-r5"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Squid");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-667.NASL
    descriptionSeveral vulnerabilities have been discovered in Squid, the internet object cache, the popular WWW proxy cache. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CAN-2005-0173 LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access controls or confusing accounting. - CAN-2005-0175 Cache pollution/poisoning via HTTP response splitting has been discovered. - CAN-2005-0194 The meaning of the access controls becomes somewhat confusing if any of the referenced ACLs (access control lists) is declared empty, without any members. - CAN-2005-0211 The length argument of the WCCP recvfrom() call is larger than it should be. An attacker may send a larger than normal WCCP packet that could overflow a buffer.
    last seen2020-06-01
    modified2020-06-02
    plugin id16341
    published2005-02-10
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16341
    titleDebian DSA-667-1 : squid - several vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SA_2005_006.NASL
    descriptionThe remote host is missing the patch for the advisory SUSE-SA:2005:006 (squid). Squid is a feature-rich web-proxy with support for various web-related protocols. The last two squid updates from February the 1st and 10th fix several vulnerabilities. The impact of them range from remote denial-of-service over cache poisoning to possible remote command execution. Due to the hugh amount of bugs the vulnerabilities are just summarized here. CVE-2005-0094 A buffer overflow in the Gopher responses parser leads to memory corruption and usually crash squid. CVE-2005-0095 An integer overflow in the receiver of WCCP (Web Cache Communication Protocol) messages can be exploited remotely by sending a specially crafted UDP datagram to crash squid. CVE-2005-0096 A memory leak in the NTLM fakeauth_auth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial-of-service due to uncontrolled memory consumption. CVE-2005-0097 The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a crash od squid by sending a malformed NTLM message. CVE-2005-0173 LDAP handles search filters very laxly. This behaviour can be abused to log in using several variants of a login name, possibly bypassing explicit access controls or confusing accounting. CVE-2005-0175 and CVE-2005-0174 Minor problems in the HTTP header parsing code that can be used for cache poisoning. CVE-2005-0211 A buffer overflow in the WCCP handling code in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial-of-service and possibly execute arbitrary code by using a long WCCP packet. CVE-2005-0241 The httpProcessReplyHeader function in Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling
    last seen2020-06-01
    modified2020-06-02
    plugin id16372
    published2005-02-10
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16372
    titleSUSE-SA:2005:006: squid

Oval

accepted2013-04-29T04:04:02.187-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
    ovaloval:org.mitre.oval:def:11831
  • commentCentOS Linux 4.x
    ovaloval:org.mitre.oval:def:16636
  • commentOracle Linux 4.x
    ovaloval:org.mitre.oval:def:15990
descriptionsquid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.
familyunix
idoval:org.mitre.oval:def:10251
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleThe NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference.
version26

Redhat

advisories
  • rhsa
    idRHSA-2005:060
  • rhsa
    idRHSA-2005:061
rpms
  • squid-7:2.5.STABLE6-3.4E.3
  • squid-debuginfo-7:2.5.STABLE6-3.4E.3
  • squid-7:2.5.STABLE3-6.3E.7
  • squid-debuginfo-7:2.5.STABLE3-6.3E.7