Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 80201

Summary: www-proxy/squid: Buffer overflow in WCCP recvfrom() call
Product: Gentoo Security Reporter: Jean-Fran├žois Brunette (RETIRED) <formula7>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: andrewbevitt
Priority: High    
Version: unspecified   
Hardware: All   
OS: All   
Whiteboard: A3 [glsa] jaervosz
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 79495    

Description Jean-Fran├žois Brunette (RETIRED) gentoo-dev 2005-01-31 05:47:40 UTC
Problem Description:

 The WCCP recvfrom() call accepts more data than will fit in
 the allocated buffer.  An attacker may send a larger-than-normal
 WCCP message to Squid and overflow this buffer.


 The bug is important because it allows remote attackers to crash
 Squid, causing a disription in service.  However, the bug is
 exploitable only if you have configured Squid to send WCCP messages
 to, and expect WCCP replies from, a router.

 Sites that do not use WCCP are not vulnerable.


Updated Packages:

 An individual patch for this issues can be found in our
 patch archive for version Squid-2.5.STABLE7:

 If necessary, this short patch should also apply to previous
 versions of Squid.

 If you are using a prepackaged version of Squid then please
 refer to the package vendor for availability information on
 updated packages.


Determining if your version is vulnerable:

 Your installation is vulnerable if you have configured Squid to
 send WCCP messages to a router, and thus expect replies from a
 router.  Look for the 'wccp_router' dirctive in your squid.conf
 file.  Also, look for this line in cache.log:

  Accepting WCCP messages on port 2048, FD 15



 If WCCP is not essential to your operation, disable it
 by commenting out the 'wccp_router' directive in

 You may also compile Squid without any WCCP code at all
 by giving the --disable-wccp option to the ./configure
Comment 1 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-01-31 05:54:53 UTC
Andrew please bump.

The date on squid-2.5.STABLE7-response_splitting.patch seems to have changed also. Did they change the patch?
Comment 2 Andrew Bevitt 2005-02-01 01:53:06 UTC
See squid-2.5.7-r5 patchset 20050201
Comment 3 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-02-01 02:15:38 UTC
Thx Andrew.

This one is ready for GLSA.

The patch was changed slightly in squid-2.5.7-r5 patchset 20050201:
< Index: squid/src/store_digest.c
< diff -c squid/src/store_digest.c:1.51 squid/src/store_digest.c:
< *** squid/src/store_digest.c:1.51     Wed Oct 24 00:55:44 2001
< --- squid/src/store_digest.c  Sun Jan 30 18:49:42 2005
< ***************
< *** 387,392 ****
< --- 387,393 ----
<       (long int) e->mem_obj->reply->expires, (int) (e->mem_obj->reply->expires - squid_curtime));
<       storeBuffer(e);
<       httpReplySwapOut(e->mem_obj->reply, e);
< +     e->mem_obj->reply->hdr_sz = e->mem_obj->inmem_hi;
<       storeDigestCBlockSwapOut(e);
<       storeBufferFlush(e);
<       eventAdd("storeDigestSwapOutStep", storeDigestSwapOutStep, sd_state.rewrite_lock, 0.0, 1);
Comment 4 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-02-02 12:38:30 UTC
GLSA 200502-04