Bug 410181 (CVE-2007-6239)

Summary: CVE-2007-6239 squid: DoS in cache updates
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kreilly, mbacovsk, mmayer, mnagy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
Whiteboard: source=vendorsec,reported=20071204,public=20071204,impact=moderate
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-12-18 11:23:07 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 412321, 412331, 412341, 412351, 412361, 412371, 412381, 412391    
Bug Blocks:    

Description Tomas Hoger 2007-12-04 06:32:15 EST
Squid security advisory SQUID-2007:2 was published recently:

http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

Problem Description:

 Due to incorrect bounds checking Squid is vulnerable to
 a denial of service check during some cache update reply
 processing.

Severity:

 This problem allows any client trusted to use the service to
 perform a denial of service attack on the Squid service.
Comment 4 Tomas Hoger 2007-12-05 11:33:42 EST
Based on additional info from Adrian Chadd:

Due to the way internal squid's Arrays are handled, additional requests for the
cached object can cause additional memory to be used for that object.  As with
each request only few extra bytes are wasted, attacker would have to create a
large amount of requests to exhaust all available memory and possibly trigger
DoS condition.

Lowering impact to moderate.
Comment 6 Tomas Hoger 2007-12-06 03:38:23 EST
(In reply to comment #4)
> Due to the way internal squid's Arrays are handled, additional requests for the
> cached object can cause additional memory to be used for that object.  As with
> each request only few extra bytes are wasted, attacker would have to create a
> large amount of requests to exhaust all available memory and possibly trigger
> DoS condition.

According to Adrian, before hitting memory limits, it's more likely that an
attacker is able to trigger high CPU usage by requesting certain cached objects,
as growing Array of HTTP headers is processed linearly, i.e. with O(n) complexity.
Comment 8 Fedora Update System 2007-12-06 15:49:45 EST
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'
Comment 9 Fedora Update System 2007-12-06 15:50:41 EST
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'
Comment 13 Fedora Update System 2007-12-15 12:48:02 EST
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2007-12-15 12:48:57 EST
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 17 Tomas Hoger 2007-12-18 11:23:07 EST
Fixed now in all supported versions of Red Hat Enterprise Linux:

  https://rhn.redhat.com/errata/RHSA-2007-1130.html

and Fedora:

  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4161
  https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4170