bugtraq - ICAP adaptation: missing data flow control to client side

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200903261613.33174.m.huter@phion.com>
Date: Thu, 26 Mar 2009 16:13:32 +0100
From: Martin Huter <m.huter@...on.com>
To: bugtraq@...urityfocus.com
Subject: ICAP adaptation: missing data flow control to client side

Summary
=======

squid proxys ICAP adaptation is missing data flow control to client side. Thus 
blocking 
clients may cause a denial of service condition when requesting huge 
downloads.

Affected Versions
=================

All squid 3.x versions

Not vulnerable
==============

None of phions HTTP proxy services (in any version) is affected.

Details
=======

squids ICAP adaptation implementation does not check body-pipes buffer size
before reading from an ICAP-server.

If the client does not read from the open connection (i.e. the user does not
confirm the browsers download-message-box in microsofts IE), squid keeps on
reading data from the ICAP server into the body pipe, whilst no more data
can be delivered to the client. 
Thus the body pipes buffer is growing and squid may - in worst case - consume
memory up to the size of the users download.
Details can be found on http://www.squid-cache.org/bugs/show_bug.cgi?id=2619

Workarounds
===========

None except disabling content adaptation via ICAP.

-- 
Martin Huter
Unit Manager
Release Manager
phion AG
Eduard-Bodem-Gasse 1
A-6020 Innsbruck

Tel:     +43 (0) 508 100
Fax:     +43 (0) 508 100 20
Mail:    m.huter@...on.com
Web:     http://www.phion.com

phion AG
Vorsitzender des Aufsichtsrates: Dr. Karl  Lamprecht
Vorstand: Dr. Wieland Alge, Mag. Günter Klausner
Sitz der Gesellschaft: 6020 Innsbruck, Österreich
Handelsgericht Innsbruck Firmenbuch: 184392s
UID-Nr:: ATU47509003