Squid security advisory SQUID-2007:2 was published recently: http://www.squid-cache.org/Advisories/SQUID-2007_2.txt Problem Description: Due to incorrect bounds checking Squid is vulnerable to a denial of service check during some cache update reply processing. Severity: This problem allows any client trusted to use the service to perform a denial of service attack on the Squid service.
Based on additional info from Adrian Chadd: Due to the way internal squid's Arrays are handled, additional requests for the cached object can cause additional memory to be used for that object. As with each request only few extra bytes are wasted, attacker would have to create a large amount of requests to exhaust all available memory and possibly trigger DoS condition. Lowering impact to moderate.
(In reply to comment #4) > Due to the way internal squid's Arrays are handled, additional requests for the > cached object can cause additional memory to be used for that object. As with > each request only few extra bytes are wasted, attacker would have to create a > large amount of requests to exhaust all available memory and possibly trigger > DoS condition. According to Adrian, before hitting memory limits, it's more likely that an attacker is able to trigger high CPU usage by requesting certain cached objects, as growing Array of HTTP headers is processed linearly, i.e. with O(n) complexity.
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update squid'
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update squid'
squid-2.6.STABLE17-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
squid-2.6.STABLE16-2.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
Fixed now in all supported versions of Red Hat Enterprise Linux: https://rhn.redhat.com/errata/RHSA-2007-1130.html and Fedora: https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4161 https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4170
The advisory for this bug http://www.squid-cache.org/Advisories/SQUID-2007_2.txt was updated: http://marc.info/?l=squid-announce&m=120614453813157&w=2