Ubuntu 4.10 : squid vulnerabilities (USN-77-1)

Ubuntu Security Notice (C) 2005-2016 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

A possible authentication bypass was discovered in the LDAP
authentication backend. LDAP ignores leading and trailing whitespace
in search filters. This could possibly be abused to bypass explicit
access controls or confuse accounting when using several variants of
the login name. (CAN-2005-0173)

Previous Squid versions were not strict enough while parsing HTTP
requests and responses. Various violations of the HTTP protocol, such
as multiple Content-Length header lines, invalid 'Carriage Return'
characters, and HTTP header names containing whitespace, led to cache
pollution and could possibly be exploited to deliver wrong content to
clients. (CAN-2005-0174)

Squid was susceptible to a cache poisoning attack called 'HTTP
response splitting', where false replies are injected in the HTTP
stream. This allowed malicious web servers to forge wrong cache
content for arbitrary websites, which was then delivered to Squid
clients. (CAN-2005-0175)

The FSC Vulnerability Research Team discovered a buffer overflow in
the WCCP handling protocol. By sending an overly large WCCP packet, a
remote attacker could crash the Squid server, and possibly even
execute arbitrary code with the privileges of the 'proxy' user.
(CAN-2005-0211).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 20699 ()

Bugtraq ID:

CVE ID: CVE-2005-0173
CVE-2005-0174
CVE-2005-0175
CVE-2005-0211