Bug 156162

Summary:	CVE-1999-0710 cachemgr.cgi access control bypass
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	squid	Assignee:	Jay Fenlason <fenlason>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	medium
Version:	3	CC:	jfeeney
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,public=19990725,source=squid,reported=20050426
Fixed In Version:	7:2.5.STABLE9-1.FC3.6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-24 19:19:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2005-04-28 01:14:58 UTC

+++ This bug was initially created as a clone of Bug #156161 +++

The RedHat squid program installs cachemgr.cgi in a public web directory,
allowing remote attackers to use it as an intermediary to connect to other systems.

This patch adds access controls to the cachemgr.cgi script, preventing it from
being abused to reach other servers than allowed in a local configuration file.

http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf