Bug 410181 (CVE-2007-6239)

Summary:	CVE-2007-6239 squid: DoS in cache updates
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kreilly, mbacovsk, mmayer, mnagy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-12-18 16:23:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	412321, 412331, 412341, 412351, 412361, 412371, 412381, 412391
Bug Blocks:

Description Tomas Hoger 2007-12-04 11:32:15 UTC

Squid security advisory SQUID-2007:2 was published recently:

http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

Problem Description:

 Due to incorrect bounds checking Squid is vulnerable to
 a denial of service check during some cache update reply
 processing.

Severity:

 This problem allows any client trusted to use the service to
 perform a denial of service attack on the Squid service.

Comment 4 Tomas Hoger 2007-12-05 16:33:42 UTC

Based on additional info from Adrian Chadd:

Due to the way internal squid's Arrays are handled, additional requests for the
cached object can cause additional memory to be used for that object.  As with
each request only few extra bytes are wasted, attacker would have to create a
large amount of requests to exhaust all available memory and possibly trigger
DoS condition.

Lowering impact to moderate.

Comment 6 Tomas Hoger 2007-12-06 08:38:23 UTC

(In reply to comment #4)
> Due to the way internal squid's Arrays are handled, additional requests for the
> cached object can cause additional memory to be used for that object.  As with
> each request only few extra bytes are wasted, attacker would have to create a
> large amount of requests to exhaust all available memory and possibly trigger
> DoS condition.

According to Adrian, before hitting memory limits, it's more likely that an
attacker is able to trigger high CPU usage by requesting certain cached objects,
as growing Array of HTTP headers is processed linearly, i.e. with O(n) complexity.

Comment 8 Fedora Update System 2007-12-06 20:49:45 UTC

squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'

Comment 9 Fedora Update System 2007-12-06 20:50:41 UTC

squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'

Comment 13 Fedora Update System 2007-12-15 17:48:02 UTC

squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2007-12-15 17:48:57 UTC

squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Tomas Hoger 2007-12-18 16:23:07 UTC

Fixed now in all supported versions of Red Hat Enterprise Linux:

  https://rhn.redhat.com/errata/RHSA-2007-1130.html

and Fedora:

  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4161
  https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4170

Comment 18 Martin Nagy 2008-03-25 10:14:12 UTC

The advisory for this bug
http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
was updated:
http://marc.info/?l=squid-announce&m=120614453813157&w=2