Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL.

Two buffer overflows in squidGard were fixed :

CVE-2009-3700: Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters, related to 'emergency mode.'

CVE-2009-3826: Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL.

Also a logrotate mistake was fixed.

It was discovered that in squidguard, a URL redirector/filter/ACL plugin for squid, several problems in src/sgLog.c and src/sgDiv.c allow remote users to either :

  - cause a denial of service, by requesting long URLs     containing many slashes; this forces the daemon into     emergency mode, where it does not process requests     anymore.
  - bypass rules by requesting URLs whose length is close to     predefined buffer limits, in this case 2048 for     squidguard and 4096 or 8192 for squid (depending on its     version).

Multiple vulnerabilities has been found and corrected in squidGuard :

Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters, related to emergency mode. (CVE-2009-3700).

Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL (CVE-2009-3826).

squidGuard was upgraded to 1.2.1 for MNF2/CS3/CS4 with additional upstream security and bug fixes patches applied.

This update fixes these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

SquidGuard website reports :

Patch 20091015 fixes one buffer overflow problem in sgLog.c when overlong URLs are requested. SquidGuard will then go into emergency mode were no blocking occurs. This is not required in this situation.

Patch 20091019 fixes two bypass problems with URLs which length is close to the limit defined by MAX_BUF (default: 4096) in squidGuard and MAX_URL (default : 4096 in squid 2.x and 8192 in squid 3.x) in squid. For this kind of URLs the proxy request exceeds MAX_BUF causing squidGuard to complain about not being able to parse the squid request. Increasing the buffer limit to be higher than the one defined in MAX_URL solves the issue.

ID	Name	Product	Family	Severity
75748	openSUSE Security Update : squidGuard (openSUSE-SU-2010:0460-1)	Nessus	SuSE Local Security Checks	medium
48238	openSUSE Security Update : squidGuard (openSUSE-SU-2010:0460-1)	Nessus	SuSE Local Security Checks	medium
48235	openSUSE Security Update : squidGuard (openSUSE-SU-2010:0460-1)	Nessus	SuSE Local Security Checks	medium
46213	Debian DSA-2040-1 : squidguard - buffer overflow	Nessus	Debian Local Security Checks	medium
42356	Mandriva Linux Security Advisory : squidGuard (MDVSA-2009:293-1)	Nessus	Mandriva Local Security Checks	medium
42213	FreeBSD : squidGuard -- multiple vulnerabilities (692ab645-bf5d-11de-849b-00151797c2d4)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-3826

high

Tenable Plugins

medium

medium

medium

medium

medium

medium