Bug 53906 - Squid allows all proxy requests in accelerator mode
Summary: Squid allows all proxy requests in accelerator mode
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: squid   
(Show other bugs)
Version: 6.2
Hardware: All Linux
high
medium
Target Milestone: ---
Assignee: Bill Nottingham
QA Contact:
URL:
Whiteboard:
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-09-21 09:47 UTC by bastiaan
Modified: 2014-03-17 02:23 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-09-21 09:47:49 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2001:113 normal SHIPPED_LIVE : New squid packages available to fix FTP-based DoS 2001-09-25 04:00:00 UTC

Description bastiaan 2001-09-21 09:47:45 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.6 i686; en-US; rv:0.9.1)
Gecko/20010608

Description of problem:
If squid is configured in acccelerator only mode, it will serve any proxy
request sent to the HTTP port.
This is a known security bug fixed over a year ago (see the ChangeLog of
Squid2.3stable5)!


Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.telnet squidaccel server 80
2.GET http://random.remote.server.com/ HTTP/1.0 
3.
	

Actual Results:  Squid serves the page. 

Expected Results:  It should refuse the request.

Additional info:

This bug has been fixed in Squid 2.3stable5 with patch:
http://www.squid-cache.org/Versions/v2/2.3/bugs/squid-2.3.stable4-accel_only_access.patch

This squid website reports this bug was introduces in stable2, but RedHats
stable1 release also has it, due to inclusion of this patch:
http://www.squid-cache.org/Versions/v2/2.3/bugs/squid-2.3.stable1-accel_only_access_denied.patch

Comment 1 Bill Nottingham 2001-10-17 14:03:22 UTC
This was fixed in the recent errata release of Squid for 6.2.


Note You need to log in before you can comment on or make changes to this bug.