发布日期：2005-02-02
更新日期：2005-02-24

受影响系统：

S.u.S.E. Linux 9.2
S.u.S.E. Linux 9.1
S.u.S.E. Linux 9.0
S.u.S.E. Linux 8.2
S.u.S.E. Linux 8.1
S.u.S.E. Linux 8.0 i386
S.u.S.E. Linux 8.0
Squid Web Proxy Cache 2.5 STABLE7
Squid Web Proxy Cache 2.5 STABLE6
Squid Web Proxy Cache 2.5 STABLE5
Squid Web Proxy Cache 2.5 STABLE4
Squid Web Proxy Cache 2.5 STABLE3
Squid Web Proxy Cache 2.5 STABLE1
Squid Web Proxy Cache 2.4 STABLE7
Squid Web Proxy Cache 2.4 STABLE6
Squid Web Proxy Cache 2.4 STABLE2
Squid Web Proxy Cache 2.4
Squid Web Proxy Cache 2.3 STABLE5
Squid Web Proxy Cache 2.3 STABLE4
Squid Web Proxy Cache 2.1 PATCH2
Squid Web Proxy Cache 2.0 PATCH2

描述：

---

BUGTRAQ  ID: 12433
CVE(CAN) ID: CVE-2005-0175

Squid是一个高效的Web缓存及代理程序，Squid最初是为Unix平台开发的，现在也被移植到Linux和大多数的Unix类系统中，最新的Squid可以运行在Windows平台下。

Squid在处理畸形HTTP请求和应答时存在问题，远程攻击者可以利用这个漏洞在squid缓存中放置不安全或错误的内容。

由于Squid在处理HTTP协议时对用户数据缺少充分过滤，由于对Content-length字段，CR字符和HTTP头字段名中的空白字符缺少充分正确的处理，攻击者可以提交特殊构建的请求，允许Squid缓存不正确的内容。

<*链接：http://www.securityfocus.com/advisories/8099
        http://www.securityfocus.com/advisories/8001
        http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow
        http://www.securityfocus.com/advisories/8051
        http://www.securityfocus.com/advisories/8008
        http://security.gentoo.org/glsa/glsa-200502-04.xml
                        http://lwn.net/Alerts/123128/?format=printable
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 关闭客户端和服务端的持久连接。

厂商补丁：

Squid
-----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-wccp_buffer_overflow.patch

Squid Web Proxy Cache 2.4 .STABLE7:

SuSE Upgrade squid-2.4.STABLE7-288.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/squid-2.4.STABLE7-288.i586.rpm

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1

Mandrake Upgrade squid-2.4.STABLE7-2.4.C21mdk.x86_64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 2.1/x86_64

Squid Web Proxy Cache 2.4 .STABLE6:

Debian Upgrade squid_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_alpha.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_alpha.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_arm.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_arm.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_i386.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_i386.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_ia64.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_ia64.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_hppa.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_hppa.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_hppa.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_hppa.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_hppa.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_hppa.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_m68k.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_m68k.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_m68k.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_m68k.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_m68k.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_m68k.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_mips.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_mips.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_mips.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_mips.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_mips.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_mips.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_mipsel.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_mipsel.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_mipsel.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_mipsel.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_powerpc.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_powerpc.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_powerpc.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_powerpc.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_s390.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_s390.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_s390.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_s390.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_s390.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_s390.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid_2.4.6-2woody6_sparc.deb
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody6_sparc.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squid-cgi_2.4.6-2woody6_sparc.deb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody6_sparc.deb
Debian GNU/Linux 3.0 alias woody

Debian Upgrade squidclient_2.4.6-2woody6_sparc.deb
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody6_sparc.deb
Debian GNU/Linux 3.0 alias woody

Squid Web Proxy Cache 2.5 .STABLE7:

Squid Patch squid-2.5.STABLE7-header_parsing.patch
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-header_parsing.patch

Squid Web Proxy Cache 2.5 .STABLE6:

SuSE Upgrade squid-2.5.STABLE6-6.6.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/squid-2.5.STABLE6-6.6.i586.rpm

SuSE Upgrade squid-2.5.STABLE6-6.6.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/squid-2.5.STABLE6-6.6.x86_64.rpm

Mandrake Upgrade squid-2.5.STABLE6-2.3.101mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Linux 10.1

Mandrake Upgrade squid-2.5.STABLE6-2.3.101mdk.x86_64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Linux 10.1/x86_64

TurboLinux Upgrade squid-2.5.STABLE6-18.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/squid-2.5.STABLE6-18.i586.rpm

TurboLinux Upgrade squid-debug-2.5.STABLE6-18.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/squid-debug-2.5.STABLE6-18.i586.rpm

TurboLinux Upgrade squid-2.5.STABLE6-18.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/squid-2.5.STABLE6-18.i586.rpm

TurboLinux Upgrade squid-2.5.STABLE6-18.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/squid-2.5.STABLE6-18.i586.rpm

TurboLinux Upgrade squid-2.5.STABLE6-18.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/squid-2.5.STABLE6-18.i586.rpm

TurboLinux Upgrade squid-2.5.STABLE6-18.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/squid-2.5.STABLE6-18.i586.rpm

Squid Web Proxy Cache 2.5 .STABLE5:

Ubuntu Upgrade squid-common_2.5.5-6ubuntu0.4_all.deb
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.5.5-6ubuntu0.4_all.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squid_2.5.5-6ubuntu0.4_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.4_amd64.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squid_2.5.5-6ubuntu0.4_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.4_i386.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squid_2.5.5-6ubuntu0.4_powerpc.deb
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.5.5-6ubuntu0.4_powerpc.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squid-cgi_2.5.5-6ubuntu0.4_amd64.deb
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.5-6ubuntu0.4_amd64.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squidclient_2.5.5-6ubuntu0.4_amd64.deb
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.5-6ubuntu0.4_amd64.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squid-cgi_2.5.5-6ubuntu0.4_i386.deb
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.5-6ubuntu0.4_i386.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squidclient_2.5.5-6ubuntu0.4_i386.deb
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.5-6ubuntu0.4_i386.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squid-cgi_2.5.5-6ubuntu0.4_powerpc.deb
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.5.5-6ubuntu0.4_powerpc.deb
Ubuntu 4.10 (Warty Warthog)

Ubuntu Upgrade squidclient_2.5.5-6ubuntu0.4_powerpc.deb
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squidclient_2.5.5-6ubuntu0.4_powerpc.deb
Ubuntu 4.10 (Warty Warthog)

SuSE Upgrade squid-2.5.STABLE5-42.27.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/squid-2.5.STABLE5-42.27.i586.rpm

SuSE Upgrade squid-2.5.STABLE5-42.27.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/squid-2.5.STABLE5-42.27.x86_64.rpm

Squid Web Proxy Cache 2.5 .STABLE4:

Mandrake Upgrade squid-2.5.STABLE4-2.4.100mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Linux 10.0

Mandrake Upgrade squid-2.5.STABLE4-2.4.100mdk.amd64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Linux 10.0/AMD64

Mandrake Upgrade squid-2.5.STABLE4-2.4.C30mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 3.0

Mandrake Upgrade squid-2.5.STABLE4-2.4.C30mdk.x86_64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Corporate Server 3.0/x86_64

Squid Web Proxy Cache 2.5 .STABLE3:

SuSE Upgrade squid-2.5.STABLE3-118.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/squid-2.5.STABLE3-118.i586.rpm

SuSE Upgrade squid-2.5.STABLE3-118.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/squid-2.5.STABLE3-118.x86_64.rpm

Mandrake Upgrade squid-2.5.STABLE3-3.6.92mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Linux 9.2

Mandrake Upgrade squid-2.5.STABLE3-3.6.92mdk.amd64.rpm
http://www.mandrakesecure.net/en/ftp.php
Mandrake Linux 9.2/AMD64

Squid Web Proxy Cache 2.5 .STABLE1:

SuSE Upgrade squid-2.5.STABLE1-106.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/squid-2.5.STABLE1-106.i586.rpm

浏览次数：3494
严重程度：0（网友投票）