----------------------------------------------------------------------

Want a new IT Security job?

Vacant positions at Secunia:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Squid HTTP Specifications Web Proxy Cache Poisoning

SECUNIA ADVISORY ID:
SA15093

VERIFY ADVISORY:
http://secunia.com/advisories/15093/

CRITICAL:
Less critical

IMPACT:
Manipulation of data

WHERE:
>From local network

SOFTWARE:
Squid 2.x
http://secunia.com/product/310/

DESCRIPTION:
Steve Orrin has reported a vulnerability in Squid, which can be
exploited by malicious people to poison the web proxy cache.

The vulnerability is caused due to an error in the handling of
upstream HTTP agents (e.g. web servers) not complying correctly with
the HTTP specifications. This can be exploited to cause the HTTP
agent and Squid to be out-of-sync by sending a specially crafted
request containing e.g. white spaces in the HTTP header names and
extra CR characters at the end of HTTP headers.

Successful exploitation allows poisoning of the web proxy cache.

An issue, where input validation errors in dynamic web sites can be
exploited to conduct HTTP response splitting attacks, has also been
reported.

The vulnerability has been reported in versions 2.5.STABLE7 and
prior.

SOLUTION:
Update to version 2.5.STABLE8.

Apply patches for version 2.5.STABLE7:
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-header_parsing.patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-response_splitting.patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch

Disable HTTP persistent connections (see original advisory).

PROVIDED AND/OR DISCOVERED BY:
Steve Orrin, Watchfire.

ORIGINAL ADVISORY:
Squid:
http://www.squid-cache.org/Advisories/SQUID-2005_4.txt
http://www.squid-cache.org/Advisories/SQUID-2005_5.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------