Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.

When parsing the configuration file, squid interpreted empty Access Control Lists (ACLs) without defined authentication schemes in a non-obvious way. This could allow remote attackers to bypass intended ACLs. (CAN-2005-0194)

A remote Denial of Service vulnerability was discovered in the domain name resolution code. A faulty or malicious DNS server could stop the Squid server immediately by sending a malformed IP address.
(CAN-2005-0446).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Applying an empty ACL list results in unexpected behavior : anything will match an empty ACL list. For example,

The meaning of the configuration gets very confusing when we encounter empty ACLs such as

acl something src '/path/to/empty_file.txt' http_access allow something somewhere

gets parsed (with warnings) as

http_access allow somewhere

And similarily if you are using proxy_auth acls without having any auth schemes defined.

Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings. (CVE-2005-0194)

Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies. (CVE-2005-0626)

Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (segmentation fault) by aborting the connection during a (1) PUT or (2) POST request, which causes Squid to access previosuly freed memory. (CVE-2005-0718)

A bug in the way Squid processes errors in the access control list was also found. It is possible that an error in the access control list could give users more access than intended. (CVE-2005-1345)

In addition, due to subtle bugs in the previous backported updates of squid (Bugzilla #14209), all the squid-2.5 versions have been updated to squid-2.5.STABLE9 with all the STABLE9 patches from the squid developers.

The updated packages are patched to fix these problems.

The remote host is affected by the vulnerability described in GLSA-200501-25 (Squid: Multiple vulnerabilities)

    Squid contains a vulnerability in the gopherToHTML function     (CAN-2005-0094) and incorrectly checks the 'number of caches' field     when parsing WCCP_I_SEE_YOU messages (CAN-2005-0095). Furthermore the     NTLM code contains two errors. One is a memory leak in the     fakeauth_auth helper (CAN-2005-0096) and the other is a NULL pointer     dereferencing error (CAN-2005-0097). Finally Squid also contains an     error in the ACL parsing code (CAN-2005-0194).
  Impact :

    With the WCCP issue an attacker could cause denial of service by     sending a specially crafted UDP packet. With the Gopher issue an     attacker might be able to execute arbitrary code by enticing a user to     connect to a malicious Gopher server. The NTLM issues could lead to     denial of service by memory consumption or by crashing Squid. The ACL     issue could lead to ACL bypass.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Squid, the internet object cache, the popular WWW proxy cache. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CAN-2005-0173     LDAP is very forgiving about spaces in search filters     and this could be abused to log in using several     variants of the login name, possibly bypassing explicit     access controls or confusing accounting.

  - CAN-2005-0175

    Cache pollution/poisoning via HTTP response splitting     has been discovered.

  - CAN-2005-0194

    The meaning of the access controls becomes somewhat     confusing if any of the referenced ACLs (access control     lists) is declared empty, without any members.

  - CAN-2005-0211

    The length argument of the WCCP recvfrom() call is     larger than it should be. An attacker may send a larger     than normal WCCP packet that could overflow a buffer.

The remote host is running the Squid proxy. The server has web-based proxy reporting enabled. An attacker viewing these pages would be able to gain information that may be useful in future attacks. This occurs when Squid processes the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.

ID	Name	Product	Family	Severity
20709	Ubuntu 4.10 : squid vulnerabilities (USN-84-1)	Nessus	Ubuntu Local Security Checks	critical
19054	FreeBSD : squid -- confusing results on empty acl declarations (a30e5e44-5440-11d9-9e1e-c296ac722cb3)	Nessus	FreeBSD Local Security Checks	critical
18171	Mandrake Linux Security Advisory : squid (MDKSA-2005:078)	Nessus	Mandriva Local Security Checks	critical
16416	GLSA-200501-25 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
16341	Debian DSA-667-1 : squid - several vulnerabilities	Nessus	Debian Local Security Checks	critical
2491	Squid < 2.5.STABLE7 Report Information Disclosure	Nessus Network Monitor	Web Servers	critical

Detections

Analytics

CVE-2005-0194

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical