Squid Proxy squid_ldap_auth验证绕过漏洞

发布日期：2005-02-02
更新日期：2005-02-24

受影响系统：

S.u.S.E. Linux 9.2
S.u.S.E. Linux 9.1
S.u.S.E. Linux 9.0 x86_64
S.u.S.E. Linux 9.0
S.u.S.E. Linux 8.2
S.u.S.E. Linux 8.1
S.u.S.E. Linux 8.0 i386
S.u.S.E. Linux 8.0
Squid Web Proxy Cache 2.5 STABLE7
Squid Web Proxy Cache 2.5 STABLE6
Squid Web Proxy Cache 2.5 STABLE5
Squid Web Proxy Cache 2.5 STABLE4
Squid Web Proxy Cache 2.5 STABLE3
Squid Web Proxy Cache 2.5 STABLE1
Squid Web Proxy Cache 2.4 STABLE7
Squid Web Proxy Cache 2.4 STABLE6
Squid Web Proxy Cache 2.4 STABLE2
Squid Web Proxy Cache 2.4
Squid Web Proxy Cache 2.3 STABLE5
Squid Web Proxy Cache 2.3 STABLE4
Squid Web Proxy Cache 2.1 PATCH2
Squid Web Proxy Cache 2.0 PATCH2

描述：

---

BUGTRAQ ID: 12431
CVE(CAN) ID: CVE-2005-0173

Squid是一个高效的Web缓存及代理程序，Squid最初是为Unix平台开发的，现在也被移植到Linux和大多数的Unix类系统中，最新的Squid可以运行在Windows平台下。

Squid的'squid_ldap_auth'模块存在验证绕过存在问题，远程攻击者可以利用这个漏洞绕过访问控制进行未授权访问或获得特权提升。

LDAP在搜索过滤器中对空格字符缺少充分过滤，使用包含空格的各种变形登录名，可绕过访问限制进行访问。

<*来源：请见各厂商的链接

链接：http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow
http://www.securityfocus.com/advisories/8099
http://www.securityfocus.com/advisories/8051
http://www.securityfocus.com/advisories/8008
http://lwn.net/Alerts/123638/?format=printable
http://lwn.net/Alerts/123128/?format=printable
http://www.debian.org/security/2002/dsa-667
http://security.gentoo.org/glsa/glsa-200502-04.xml
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 使用如下方法阻止带空格字符的登录：

acl login_with_spaces proxy_auth_regex [:space:]
http_access deny login_with_spaces

厂商补丁：

Squid
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-wccp_buffer_overflow.patch

Squid Web Proxy Cache 2.4 .STABLE7:

SuSE Upgrade squid-2.4.STABLE7-288.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/squid-2.4.STABLE7-288.i586.rpm

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.x86_64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1/x86_64

Squid Web Proxy Cache 2.4 .STABLE6:

Debian Upgrade squid_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_ia64.deb

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!