Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 461492 (CVE-2013-1839) - <net-proxy/squid-3.2.9: DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc (CVE-2013-1839)
Summary: <net-proxy/squid-3.2.9: DoS (loop, 100% cpu) strHdrAcptLangGetItem() at error...
Status: RESOLVED FIXED
Alias: CVE-2013-1839
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-03-12 08:56 UTC by Agostino Sarubbo
Modified: 2013-10-06 23:11 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-03-12 08:56:13 UTC
From ${URL} :

> On 6/03/2013 9:53 a.m., tytusromekiatomek@...hmail.com wrote:
>> ################################################################ 
>> # DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc # 
>> ################################################################ 
>> # # Authors: # # 22733db72ab3ed94b5f8a1ffcde850251fe6f466 #
>> c8e74ebd8392fda4788179f9a02bb49337638e7b # AKAT-1 # 
>> #######################################
>> 
>> # Versions: 3.2.5, 3.2.7
> 
> Thank you very much for reporting this to us upstream and ensuring
> a patch was available before publishing it publicly *cough*. This
> has now been fixed.
> 
> Would you care to do better on the other ones before someone else
> has a chance to mail your exploit to our bugs@ address and grab all
> the discovery glory?
Comment 1 Eray Aslan gentoo-dev 2013-03-14 07:52:42 UTC
+*squid-3.3.3 (14 Mar 2013)
+*squid-3.2.9 (14 Mar 2013)
+
+  14 Mar 2013; Eray Aslan <eras@gentoo.org> +squid-3.2.9.ebuild,
+  +squid-3.3.3.ebuild:
+  Security bump - bug #461492
+

@security:  We can stabilize =net-proxy/squid-3.2.9.  Thank you.
Comment 2 Sean Amoss gentoo-dev Security 2013-03-14 12:56:13 UTC
Arches, please test and mark stable:
=net-proxy/squid-3.2.9
Target KEYWORDS: "alpha amd64 arm hppa ia64 ~mips ppc ppc64 sparc x86 ~x86-fbsd"
Comment 3 Agostino Sarubbo gentoo-dev 2013-03-14 15:03:00 UTC
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2013-03-14 15:03:28 UTC
x86 stable
Comment 5 Agostino Sarubbo gentoo-dev 2013-03-14 15:09:09 UTC
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2013-03-14 15:13:14 UTC
ppc64 stable
Comment 7 Jeroen Roovers gentoo-dev 2013-03-14 17:31:44 UTC
Stable for HPPA.
Comment 8 Agostino Sarubbo gentoo-dev 2013-03-17 15:55:03 UTC
arm stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-03-17 16:01:56 UTC
sparc stable
Comment 10 Agostino Sarubbo gentoo-dev 2013-03-23 13:34:34 UTC
alpha stable
Comment 11 Tobias Heinlein (RETIRED) gentoo-dev 2013-03-24 19:25:13 UTC
Added to existing draft.
Comment 12 Agostino Sarubbo gentoo-dev 2013-04-01 19:45:20 UTC
ia64 stable
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2013-09-27 09:52:15 UTC
This issue was resolved and addressed in
 GLSA 201309-22 at http://security.gentoo.org/glsa/glsa-201309-22.xml
by GLSA coordinator Sergey Popov (pinkbyte).
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2013-10-06 23:11:28 UTC
CVE-2013-1839 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1839):
  The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before
  3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of
  service (infinite loop and CPU consumption) via a "," character in an
  Accept-Language header.