| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 2 Mar 2008 23:10:30 +0100 From: L4teral <l4teral@...il.com> To: bugtraq@...urityfocus.com Subject: Squid Analysis Report Generator <= 2.2.3.1 buffer overflow ====================================================================== Squid Analysis Report Generator <= 2.2.3.1 buffer overflow ====================================================================== Author: L4teral <l4teral [4t] gmail com> Impact: buffer overflow Status: fixed version available ------------------------------ Affected software description: ------------------------------ Application: Squid Analysis Report Generator Version: <= 2.2.3.1 Vendor: http://sarg.sourceforge.net Description: Squid Analysis Report Generator is a tool that allow you to view "where" your users are going to on the Internet. -------------- Vulnerability: -------------- Execution of arbitrary code is possible by executing sarg with specially crafted squid log files (access and useragent log). The access.log has to be manually created to trigger the exploit, as squid will not allow malformed HTTP methods. The useragent log is more critical, as this vulnerability can be exploited by just passing the useragent string within a request to the squid proxy. ------------ PoC/Exploit: ------------ Edit a normal access log and set the request method to an overly long string. Edit a normal useragent log and set the useragent field to an overly long string or send a request to the Squid proxy server passing an overly long string as useragent in the HTTP header. --------- Solution: --------- Upgrade to version 2.2.4 or higher. --------- Timeline: --------- 2008-01-28 - vendor informed 2008-01-28 - vendor responded 2008-03-02 - vendor released new version 2008-03-03 - public disclosure
Powered by blists - more mailing lists