Bug 410181 (CVE-2007-6239) - CVE-2007-6239 squid: DoS in cache updates
Summary: CVE-2007-6239 squid: DoS in cache updates
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-6239
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://www.squid-cache.org/Advisories...
Whiteboard:
Depends On: 412321 412331 412341 412351 412361 412371 412381 412391
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-12-04 11:32 UTC by Tomas Hoger
Modified: 2019-09-29 12:22 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-12-18 16:23:07 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:1130 normal SHIPPED_LIVE Moderate: squid security update 2007-12-18 16:19:10 UTC

Description Tomas Hoger 2007-12-04 11:32:15 UTC
Squid security advisory SQUID-2007:2 was published recently:

http://www.squid-cache.org/Advisories/SQUID-2007_2.txt

Problem Description:

 Due to incorrect bounds checking Squid is vulnerable to
 a denial of service check during some cache update reply
 processing.

Severity:

 This problem allows any client trusted to use the service to
 perform a denial of service attack on the Squid service.

Comment 4 Tomas Hoger 2007-12-05 16:33:42 UTC
Based on additional info from Adrian Chadd:

Due to the way internal squid's Arrays are handled, additional requests for the
cached object can cause additional memory to be used for that object.  As with
each request only few extra bytes are wasted, attacker would have to create a
large amount of requests to exhaust all available memory and possibly trigger
DoS condition.

Lowering impact to moderate.

Comment 6 Tomas Hoger 2007-12-06 08:38:23 UTC
(In reply to comment #4)
> Due to the way internal squid's Arrays are handled, additional requests for the
> cached object can cause additional memory to be used for that object.  As with
> each request only few extra bytes are wasted, attacker would have to create a
> large amount of requests to exhaust all available memory and possibly trigger
> DoS condition.

According to Adrian, before hitting memory limits, it's more likely that an
attacker is able to trigger high CPU usage by requesting certain cached objects,
as growing Array of HTTP headers is processed linearly, i.e. with O(n) complexity.


Comment 8 Fedora Update System 2007-12-06 20:49:45 UTC
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'

Comment 9 Fedora Update System 2007-12-06 20:50:41 UTC
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update squid'

Comment 13 Fedora Update System 2007-12-15 17:48:02 UTC
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2007-12-15 17:48:57 UTC
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Tomas Hoger 2007-12-18 16:23:07 UTC
Fixed now in all supported versions of Red Hat Enterprise Linux:

  https://rhn.redhat.com/errata/RHSA-2007-1130.html

and Fedora:

  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4161
  https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4170



Note You need to log in before you can comment on or make changes to this bug.