Squid Proxy WCCP recvfrom()远程缓冲区溢出漏洞

发布日期：2005-02-02
更新日期：2005-02-24

受影响系统：

S.u.S.E. Linux 9.2
S.u.S.E. Linux 9.1
S.u.S.E. Linux 9.0 x86_64
S.u.S.E. Linux 9.0
S.u.S.E. Linux 8.2
S.u.S.E. Linux 8.1
S.u.S.E. Linux 8.0 i386
S.u.S.E. Linux 8.0
Squid Web Proxy Cache 2.5 STABLE7
Squid Web Proxy Cache 2.5 STABLE5
Squid Web Proxy Cache 2.5 STABLE4
Squid Web Proxy Cache 2.5 STABLE3
Squid Web Proxy Cache 2.5 STABLE1
Squid Web Proxy Cache 2.4 STABLE7
Squid Web Proxy Cache 2.4 STABLE7
Squid Web Proxy Cache 2.4 STABLE6
Squid Web Proxy Cache 2.4 STABLE2
Squid Web Proxy Cache 2.4
Squid Web Proxy Cache 2.3 STABLE5
Squid Web Proxy Cache 2.1 PATCH2
Squid Web Proxy Cache 2.0 PATCH2

描述：

---

BUGTRAQ ID: 12432
CVE(CAN) ID: CVE-2005-0211

Squid是一个高效的Web缓存及代理程序，Squid最初是为Unix平台开发的，现在也被移植到Linux和大多数的Unix类系统中，最新的Squid可以运行在Windows平台下。

Squid在处理畸形WCCP包时存在问题，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以进程权限执行任意指令。

问题存在于WCCP-Web缓存通信协议，此为一个基于UDP的协议，由于WCCP recvfrom()调用对长度参数缺少充分检查，攻击者一个超大WCCP数据包可发生缓冲区溢出，精心构建提交数据可能以进程权限执行任意指令。

<*来源：FSC Internet Corporation.

链接：http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow
http://www.securityfocus.com/advisories/8099
http://www.securityfocus.com/advisories/8051
http://www.securityfocus.com/advisories/8008
http://www.debian.org/security/2002/dsa-667
http://security.gentoo.org/glsa/glsa-200502-04.xml
http://lwn.net/Alerts/123128/?format=printable
*>

建议：

---

厂商补丁：

Squid
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Squid Web Proxy Cache 2.4 .STABLE7:

SuSE Upgrade squid-2.4.STABLE7-288.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/squid-2.4.STABLE7-288.i586.rpm

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.x86_64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1/x86_64

Squid Web Proxy Cache 2.4 .STABLE6:

Debian Upgrade squid_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_hppa.deb

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!