Squid Web Proxy Cache NTLM buffer overflow
| squid-ntlm-bo (16360) |  High Risk |
Description:
Squid Web Proxy Cache is vulnerable to a buffer overflow, caused by a vulnerability in the NTLM authentication. By sending a specially-crafted password to the 'helpers/ntlm_auth/SMB/libntlmssp.c' routine in the ntlm_check_auth function, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Platforms Affected:
- Conectiva, Linux 10
- Conectiva, Linux 9.0
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 9.1 PPC
- MandrakeSoft, Mandrake Linux 9.1
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Linux 3.0
- Squid-Cache, Squid 2.0.PATCH2
- Squid-Cache, Squid 2.1.PATCH2
- Squid-Cache, Squid 2.3.STABLE5
- Squid-Cache, Squid 2.4
- Squid-Cache, Squid 2.4.STABLE7
- Squid-Cache, Squid 2.5.STABLE1
- Squid-Cache, Squid 2.5.STABLE3
- Squid-Cache, Squid 2.5.STABLE4
- Squid-Cache, Squid 2.5.STABLE5
- SuSE, SuSE Linux 8.0
- SuSE, SuSE Linux 8.2
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux 9.1
- Trustix, Secure Enterprise Linux 2.0
- Trustix, Secure Linux 2.0
- Trustix, Secure Linux 2.1
Remedy:
Apply the patch for this vulnerability, as listed in iDEFENSE Security Advisory 06.08.04. See References.
For Red Hat Linux:
Upgrade to the latest squid package, as listed below. Refer to RHSA-2004:242-06 for more information. See References.
Red Hat Enterprise Linux (v. 3), AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 2.5.STABLE3-6.3E.x86 or later
For SuSE Linux:
Upgrade to the latest CVS package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2004:016 for more information. See References.
SuSE Linux 9.1: 2.5.STABLE5-42.9 or later
SuSE Linux 9.0: 2.5.STABLE3-110 or later
SuSE Linux 8.2: 2.5.STABLE1-98 or later
SuSE Linux 8.0: 2.4.STABLE6-9 or later
For Mandrake Linux:
Upgrade to the latest squid package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:059 : squid for more information.See References.
Mandrake Linux 9.1: 2.5.STABLE1-7.2.91mdk or later
Mandrake Linux 9.2: 2.5.STABLE3-3.2.92mdk or later
Mandrake Linux 10.0: 2.5.STABLE4-1.2.100mdk or later
For Trustix Secure Linux:
Upgrade to the latest squid package, as listed below. Refer to Trustix Secure Linux Security Advisory #2004-0033 for more information. See References.
Trustix Secure Linux 2.0: 2.5.STABLE5-0.2tr or later
Trustix Secure Linux 2.1 and Enterprise Linux 2: 2.5.STABLE5-5tr or later
For Gentoo Linux:
Upgrade to the latest version of squid (2.5.5-r2 or later), as listed in GLSA 200406-13. See References.
For Conectiva Linux:
Upgrade to the latest squid package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:882 for more information. See References.
Conectiva Linux 10.0: 2.5.5-63116U10_4cl or later
Conectiva Linux 9: 2.5.5-25761U90_7cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- CIAC Information Bulletin O-168, Squid - NTLM Authentication Buffer Overflow Vulnerability at http://www.ciac.org/ciac/bulletins/o-168.shtml.
- Conectiva Linux Security Announcement CLSA-2004:882, Fixes for squid vulnerabilities at http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000882.
- GLSA 200406-13, Squid: NTLM authentication helper buffer overflow at http://www.linuxsecurity.com/content/view/106181/104/.
- iDEFENSE Security Advisory 06.08.04, Squid Web Proxy Cache NTLM Authentication Helper Buffer Overflow Vulnerability at http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0191.html.
- Squid Proxy Cache Security Update Advisory SQUID-2004:2, Buffer overflow bug in 'ntlm_auth' authentication helper. at http://www.squid-cache.org/Advisories/SQUID-2004_2.txt.
- Squid Web Proxy Cache Web site, Squid Web Proxy Cache at http://www.squid-cache.org/.
- Squid Web Proxy Cache Web site, Squid-2.5 Patches at http://www.squid-cache.org/Versions/v2/2.5/bugs/. (Patch)
- Trustix Secure Linux Security Advisory #2004-0033, squid at http://www.linuxsecurity.com/content/view/106152/109/.
- BID-10500: Squid Proxy NTLM Authentication Buffer Overflow Vulnerability
- CVE-2004-0541: Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password (pass variable).
- GLSA-200406-13: Squid: NTLM authentication helper buffer overflow
- MDKSA-2004:059: Updated squid packages fix remotely exploitable vulnerability
- RHSA-2004-242: squid security update
- SUSE-SA:2004:016: squid: remote system compromise
Reported:
Jun 08, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net