Ubuntu 4.10 : squid vulnerabilities (USN-77-1)

Ubuntu Security Notice (C) 2005-2013 Canonical, Inc. / NASL script (C) 2006-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

A possible authentication bypass was discovered in the LDAP
authentication backend. LDAP ignores leading and trailing whitespace
in search filters. This could possibly be abused to bypass explicit
access controls or confuse accounting when using several variants of
the login name. (CAN-2005-0173)

Previous Squid versions were not strict enough while parsing HTTP
requests and responses. Various violations of the HTTP protocol, such
as multiple Content-Length header lines, invalid 'Carriage Return'
characters, and HTTP header names containing whitespace, led to cache
pollution and could possibly be exploited to deliver wrong content to
clients. (CAN-2005-0174)

Squid was susceptible to a cache poisoning attack called 'HTTP
response splitting', where false replies are injected in the HTTP
stream. This allowed malicious web servers to forge wrong cache
content for arbitrary web sites, which was then delivered to Squid
clients. (CAN-2005-0175)

The FSC Vulnerability Research Team discovered a buffer overflow in
the WCCP handling protocol. By sending an overly large WCCP packet, a
remote attacker could crash the Squid server, and possibly even
execute arbitrary code with the privileges of the 'proxy' user.
(CAN-2005-0211).

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 20699 ()

Bugtraq ID:

CVE ID: CVE-2005-0173
CVE-2005-0174
CVE-2005-0175
CVE-2005-0211