Squid Cache FTP 代理处理URL时存在缓冲溢出漏洞发布时间：2002-02-26 更新时间：2002-02-26 严重程度：中 威胁程度：普通用户访问权限 错误类型：边界检查错误 利用方式：服务器模式 BUGTRAQ ID：4148 受影响系统 National Science Foundation Squid Web Proxy 2.0详细描述 Squid proxy服务程序的FTP 在处理URL时存在缓冲溢出。 如果用户能是使用Squid处理代理FTP请求，就可能导致用户请求恶意的超长的 ftp://URL而导致服务产生缓冲溢出，需要重新启动才能获得正常功能。 测试代码 尚无 解决方案 临时方法： 编辑squid.conf文件关闭匿名的FTP请求： acl non-anonymous-ftp url_regex -i ^ftp://[^/@]*@ http_access deny non-anonymous-ftp 你也可以下载使用如下补丁程序： National Science Foundation Squid Web Proxy 2.0: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.1: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.2: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.3STABLE5: Trustix RPM squid-2.4.STABLE4-1tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/squid-2.4.STABLE4-1tr.i586.rpm Release 1.1 Trustix RPM squid-2.4.STABLE4-1tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/squid-2.4.STABLE4-1tr.i586.rpm Release 1.2 Trustix RPM squid-2.4.STABLE4-1tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/squid-2.4.STABLE4-1tr.i586.rpm Release 1.5 National Science Foundation Squid Web Proxy 2.3: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.4STABLE3: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.4STABLE2: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.4STABLE1: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz National Science Foundation Squid Web Proxy 2.4: National Science Foundation Upgrade squid-2.4.STABLE4-src.tar.gz http://www.squid-cache.org/Versions/v2/2.4/squid-2.4.STABLE4-src.tar.gz FreeBSD Upgrade squid-2.4_8.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/squid-2.4_8.tgz For version included in ports for FreeBSD 4.x. FreeBSD Upgrade squid-2.4_8.tgz ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/squid-2.4_8.tgz For version included in ports for FreeBSD 5.0. 相关信息 Jouko Pynnonen <jouko@solutions.fi> 参考：http://online.securityfocus.com/archive/1/257614 http://online.securityfocus.com/archive/1/257370 http://online.securityfocus.com/advisories/3886 http://online.securityfocus.com/advisories/3890 |
