First Last Prev Next    This bug is not in your last search results.
Bug 452467 - squidGuard: "trailing dot" domain access restriction bypass
squidGuard: "trailing dot" domain access restriction bypass
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=gentoo,reported=20080620,publi...
: Security
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2008-06-23 03:49 EDT by Tomas Hoger
Modified: 2010-03-22 11:39 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-03-22 11:39:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Tomas Hoger 2008-06-23 03:49:54 EDT 
squidGuard upstream published security advisory regarding domain access
restriction bypass affecting systems with squid 3.0:

By adding a trailing dot to the domain it is possible to bypass the filter and
access blocked sites.

This only affects people using squidGuard with squid version 3.0 STABLE1 to
STABLE5 (higher version may be affected as well; in any case, if you are running
squid 3.0 make sure to patch). Squid version 2.6 is known to remove trailing
dots from domains before passing the URLs to squidGuard.

References:
http://www.squidguard.org/Doc/sg-2008-06-13.html
http://bugs.gentoo.org/show_bug.cgi?id=228593

See upstream advisory for patch details.

Squid 3.0 is currently shipped in Fedora 9 and Rawhide.  Fedora 8 still ships
squid 2.6 and shouldn't be affected by this issue.
Comment 1 Gwyn Ciesla 2009-02-12 09:46:38 EST 
1.2.1-2 with this patched on it's way through bodhi.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.