Squid Proxy畸形HTTP头解析缓存

发布日期：2005-02-02
更新日期：2005-02-24

受影响系统：

S.u.S.E. Linux 9.2
S.u.S.E. Linux 9.1
S.u.S.E. Linux 9.0
S.u.S.E. Linux 8.2
S.u.S.E. Linux 8.1
S.u.S.E. Linux 8.0 i386
S.u.S.E. Linux 8.0
Squid Web Proxy Cache 2.5 STABLE7
Squid Web Proxy Cache 2.5 STABLE6
Squid Web Proxy Cache 2.5 STABLE5
Squid Web Proxy Cache 2.5 STABLE4
Squid Web Proxy Cache 2.5 STABLE3
Squid Web Proxy Cache 2.5 STABLE1
Squid Web Proxy Cache 2.4 STABLE7
Squid Web Proxy Cache 2.4 STABLE6
Squid Web Proxy Cache 2.4 STABLE2
Squid Web Proxy Cache 2.4
Squid Web Proxy Cache 2.3 STABLE5
Squid Web Proxy Cache 2.3 STABLE4
Squid Web Proxy Cache 2.1 PATCH2
Squid Web Proxy Cache 2.0 PATCH2

描述：

---

BUGTRAQ ID: 12433
CVE(CAN) ID: CVE-2005-0175

Squid是一个高效的Web缓存及代理程序，Squid最初是为Unix平台开发的，现在也被移植到Linux和大多数的Unix类系统中，最新的Squid可以运行在Windows平台下。

Squid在处理畸形HTTP请求和应答时存在问题，远程攻击者可以利用这个漏洞在squid缓存中放置不安全或错误的内容。

由于Squid在处理HTTP协议时对用户数据缺少充分过滤，由于对Content-length字段，CR字符和HTTP头字段名中的空白字符缺少充分正确的处理，攻击者可以提交特殊构建的请求，允许Squid缓存不正确的内容。

<*链接：http://www.securityfocus.com/advisories/8099
http://www.securityfocus.com/advisories/8001
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow
http://www.securityfocus.com/advisories/8051
http://www.securityfocus.com/advisories/8008
http://security.gentoo.org/glsa/glsa-200502-04.xml
http://lwn.net/Alerts/123128/?format=printable
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 关闭客户端和服务端的持久连接。

厂商补丁：

Squid
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-wccp_buffer_overflow.patch

Squid Web Proxy Cache 2.4 .STABLE7:

SuSE Upgrade squid-2.4.STABLE7-288.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/squid-2.4.STABLE7-288.i586.rpm

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.x86_64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1/x86_64

Squid Web Proxy Cache 2.4 .STABLE6:

Debian Upgrade squid_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有