Bug 53906 - Squid allows all proxy requests in accelerator mode
Squid allows all proxy requests in accelerator mode
Status: CLOSED ERRATA
Product: Red Hat Linux
Classification: Retired
Component: squid (Show other bugs)
6.2
All Linux
high Severity medium
: ---
: ---
Assigned To: Bill Nottingham
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2001-09-21 05:47 EDT by bastiaan
Modified: 2014-03-16 22:23 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-09-21 05:47:49 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description bastiaan 2001-09-21 05:47:45 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.6 i686; en-US; rv:0.9.1)
Gecko/20010608

Description of problem:
If squid is configured in acccelerator only mode, it will serve any proxy
request sent to the HTTP port.
This is a known security bug fixed over a year ago (see the ChangeLog of
Squid2.3stable5)!


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.telnet squidaccel server 80
2.GET http://random.remote.server.com/ HTTP/1.0 
3.
	

Actual Results:  Squid serves the page. 

Expected Results:  It should refuse the request.

Additional info:

This bug has been fixed in Squid 2.3stable5 with patch:
http://www.squid-cache.org/Versions/v2/2.3/bugs/squid-2.3.stable4-accel_only_access.patch

This squid website reports this bug was introduces in stable2, but RedHats
stable1 release also has it, due to inclusion of this patch:
http://www.squid-cache.org/Versions/v2/2.3/bugs/squid-2.3.stable1-accel_only_access_denied.patch
Comment 1 Bill Nottingham 2001-10-17 10:03:22 EDT
This was fixed in the recent errata release of Squid for 6.2.

Note You need to log in before you can comment on or make changes to this bug.