oss-security - Squid HTTP proxy CVE request

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <559A65F3.80103@treenet.co.nz>
Date: Mon, 06 Jul 2015 23:26:43 +1200
From: Amos Jeffries <squid3@...enet.co.nz>
To: oss-security@...ts.openwall.com
Subject: Squid HTTP proxy CVE request

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings,

This months release of Squid HTTP proxy, version 3.5.6, contains fixes
for two security issues.

Issue #1:

Due to incorrect handling of peer responses in a hierarchy of 2 or
more proxies remote clients (or scripts run on a client) are able to
gain unrestricted access through a gateway proxy to its backend proxy.

If the two proxies have differing levels of security this could lead
to authentication bypass or unprivileged access to supposedly secure
resources.

<http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.p
atch>

All Squid up to and including 3.5.5 are vulnerable.

(when published the advisory for this will be
<http://www.squid-cache.org/Advisories/SQUID-2015_2.txt>)

Issue #2:

This is somewhat more obscure, and I am seeking clarification perhapse
more than assignment.

Squid up to and including 3.5.5 are apparently vulnerable to DoS
attack from malicious clients using repeated TLS renegotiation
messages. This has not been verified as it also seems to require
outdated (0.9.8l and older) OpenSSL libraries.

<http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13849.p
atch>

CVE-2009-3555 was mentioned by the submitter, but that was clearly
assigned for server-initiated renegotiation. This Squid change is
specifically for the client-initiated renegotiation part of the TLS
protocol flaw.

There may be some relevant CVE already assigned, although I've been
unable to find it. Only CVE-2011-1473 which is for the library itself
and disputed.

So, is server software being assigned specific CVE (or a shared
generic one) for resolving this flaw? Please indicate which CVE Squid
announcements should mention (if any).

Thanks,
Amos Jeffries
Squid Software Foundation
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQIcBAEBAgAGBQJVmmXyAAoJEGvSOzfXE+nLLjMP/2qTXQODFIdE9zfL3ZQ8MRhZ
Edh4PNFxSkhvVyYn8kU6ZMg2jx7hiXXEfiP/Ilvo3XcY/eDWf64g+POgLX20X5jV
o/StXDKHvcZUargImliJb2W1nalIGw1iqBERs6qwfRJhK67MHPgGWwxHu/SFEWsM
Kk2GRlGlIM4H8g7FnsDvwAnAYweGm3+iSqZlQEaX5JOqem2M8qukGziQsc28yU4E
SU5YIwNltW563pQYD+UTerz5i24Dt086in1AvSEFiLfqAMq4o3AdcFK73RhBdKyY
yJJ0rKaz3o18vtru3I7soms8dmUI0mLxX6imPrBHOeSInjGbbRvPIU3g2WYpcdwF
o6/7Xbg8HB+9QORXINqzC02aBiIJf8blleBnUKJQt1JMhQkb8vXAW4wcHoKfKTPo
w9gyhwHgbBCYk0gSQ5CuIlaqPUEPAST0DiV0OIDHltjeLSq7vsq5zij9OKLxQdDJ
nemVr03jrPHELCvV6eKXT/UJj6X+vfpCJk+giQq6rXC8ikhTvpID1aU/xOGxNJGq
ig9ThwADl6RE2/cgjh7bnz1IPcG679V85uMbwPVTXU38XmhTyWQKjDdt5DuAdd6a
RUsheekgzf5Lhhcv7/wht/ecNxDbBKvW8o8fvMinn5j9c0GNSNXtGbp8QYlySFS9
ycdNaJLFdIm8LnV5rNSW
=COJ4
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.