Bug 452467

Summary:	squidGuard: "trailing dot" domain access restriction bypass
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bressers, gwync, john, jskala
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-22 15:39:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tomas Hoger 2008-06-23 07:49:54 UTC

squidGuard upstream published security advisory regarding domain access
restriction bypass affecting systems with squid 3.0:

By adding a trailing dot to the domain it is possible to bypass the filter and
access blocked sites.

This only affects people using squidGuard with squid version 3.0 STABLE1 to
STABLE5 (higher version may be affected as well; in any case, if you are running
squid 3.0 make sure to patch). Squid version 2.6 is known to remove trailing
dots from domains before passing the URLs to squidGuard.

References:
http://www.squidguard.org/Doc/sg-2008-06-13.html
http://bugs.gentoo.org/show_bug.cgi?id=228593

See upstream advisory for patch details.

Squid 3.0 is currently shipped in Fedora 9 and Rawhide.  Fedora 8 still ships
squid 2.6 and shouldn't be affected by this issue.

Comment 1 Gwyn Ciesla 2009-02-12 14:46:38 UTC

1.2.1-2 with this patched on it's way through bodhi.