oss-security - Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201008130900.12133.thomas@suse.de>
Date: Fri, 13 Aug 2010 09:00:09 +0200
From: Thomas Biege <thomas@...e.de>
To: squid-bugs@...id-cache.org
Cc: oss-security@...ts.openwall.com
Subject: Re: RFC: squid: Fix free memory corruption and off-by-on error when comparing SNMP OIDs

Hello project maintainers,
we stumbled over two bugs in your last release because they sound like
security vulnerabilities. Can you shed some light on them for us please?

Thanks
Thomas


Am Donnerstag, 12. August 2010, 20:58:13 schrieb Josh Bressers:
> ----- "Thomas Biege" <thomas@...e.de> wrote:
> > Hello people,
> > does someone know if this bug has security implications. TIA!
> > 
> > http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID_3_1_5.html
> > http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10008.pat
> > ch
> 
> This is really two flaws. The first bit of the patch is an off by one on
> the loop that could overflow a heap buffer.
> 
> From looking at the code, I only see this function being called with static
> strings for the MIBs. I may be missing something, but it doesn't appear
> that arbitrary strings make it into this. I'm not sure if this can be
> exploted, or if it's just a bug someone noticed.
> 
> The second flaw is an invalid free. I'm not sure if arbitrary data can make
> it into this, but with current glibc memory protections, this should be a
> DoS only.
> 
> Both only seem to affect modern versions of squid. The code seems present
> in 3.1.4, but not 2.6.STABLE21 (these are two versions we ship).
> 
> Have you mailed upstream at all?
> 
> Thanks.


-- 
 Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.