[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1461620600.215751281639493592.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Thu, 12 Aug 2010 14:58:13 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: RFC: squid: Fix free memory corruption and
off-by-on error when comparing SNMP OIDs
----- "Thomas Biege" <thomas@...e.de> wrote:
> Hello people,
> does someone know if this bug has security implications. TIA!
>
> http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID_3_1_5.html
> http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10008.patch
>
This is really two flaws. The first bit of the patch is an off by one on
the loop that could overflow a heap buffer.
>From looking at the code, I only see this function being called with static
strings for the MIBs. I may be missing something, but it doesn't appear
that arbitrary strings make it into this. I'm not sure if this can be
exploted, or if it's just a bug someone noticed.
The second flaw is an invalid free. I'm not sure if arbitrary data can make
it into this, but with current glibc memory protections, this should be a
DoS only.
Both only seem to affect modern versions of squid. The code seems present
in 3.1.4, but not 2.6.STABLE21 (these are two versions we ship).
Have you mailed upstream at all?
Thanks.
--
JB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
