Bug 410181 - (CVE-2007-6239) CVE-2007-6239 squid: DoS in cache updates
CVE-2007-6239 squid: DoS in cache updates
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://www.squid-cache.org/Advisories...
source=vendorsec,reported=20071204,pu...
: Security
Depends On: 412321 412331 412341 412351 412361 412371 412381 412391
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-04 06:32 EST by Tomas Hoger
Modified: 2008-03-25 06:14 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-12-18 11:23:07 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2007-12-04 06:32:15 EST
Squid security advisory SQUID-2007:2 was published recently:

http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

Problem Description:

 Due to incorrect bounds checking Squid is vulnerable to
 a denial of service check during some cache update reply
 processing.

Severity:

 This problem allows any client trusted to use the service to
 perform a denial of service attack on the Squid service.
Comment 4 Tomas Hoger 2007-12-05 11:33:42 EST
Based on additional info from Adrian Chadd:

Due to the way internal squid's Arrays are handled, additional requests for the
cached object can cause additional memory to be used for that object.  As with
each request only few extra bytes are wasted, attacker would have to create a
large amount of requests to exhaust all available memory and possibly trigger
DoS condition.

Lowering impact to moderate.
Comment 6 Tomas Hoger 2007-12-06 03:38:23 EST
(In reply to comment #4)
> Due to the way internal squid's Arrays are handled, additional requests for the
> cached object can cause additional memory to be used for that object.  As with
> each request only few extra bytes are wasted, attacker would have to create a
> large amount of requests to exhaust all available memory and possibly trigger
> DoS condition.

According to Adrian, before hitting memory limits, it's more likely that an
attacker is able to trigger high CPU usage by requesting certain cached objects,
as growing Array of HTTP headers is processed linearly, i.e. with O(n) complexity.
Comment 8 Fedora Update System 2007-12-06 15:49:45 EST
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'
Comment 9 Fedora Update System 2007-12-06 15:50:41 EST
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'
Comment 13 Fedora Update System 2007-12-15 12:48:02 EST
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2007-12-15 12:48:57 EST
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 17 Tomas Hoger 2007-12-18 11:23:07 EST
Fixed now in all supported versions of Red Hat Enterprise Linux:

  https://rhn.redhat.com/errata/RHSA-2007-1130.html

and Fedora:

  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4161
  https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4170

Note You need to log in before you can comment on or make changes to this bug.