Bug 53906

Summary:	Squid allows all proxy requests in accelerator mode
Product:	[Retired] Red Hat Linux	Reporter:	bastiaan
Component:	squid	Assignee:	Bill Nottingham <notting>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	high
Version:	6.2	CC:	rvokal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2001-09-21 09:47:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description bastiaan 2001-09-21 09:47:45 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.6 i686; en-US; rv:0.9.1)
Gecko/20010608

Description of problem:
If squid is configured in acccelerator only mode, it will serve any proxy
request sent to the HTTP port.
This is a known security bug fixed over a year ago (see the ChangeLog of
Squid2.3stable5)!


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.telnet squidaccel server 80
2.GET http://random.remote.server.com/ HTTP/1.0 
3.
	

Actual Results:  Squid serves the page. 

Expected Results:  It should refuse the request.

Additional info:

This bug has been fixed in Squid 2.3stable5 with patch:
http://www.squid-cache.org/Versions/v2/2.3/bugs/squid-2.3.stable4-accel_only_access.patch

This squid website reports this bug was introduces in stable2, but RedHats
stable1 release also has it, due to inclusion of this patch:
http://www.squid-cache.org/Versions/v2/2.3/bugs/squid-2.3.stable1-accel_only_access_denied.patch

Comment 1 Bill Nottingham 2001-10-17 14:03:22 UTC

This was fixed in the recent errata release of Squid for 6.2.