OSVDB ID: 6791

Title: Squid ntlm_check_auth Function NTLM Authentication Helper Password Handling Remote Overflow

Info

Disclosure
Jun 08, 2004

Discovery
Jun 09, 2004

Dates

Exploit
Jun 09, 2004

Solution
Unknown

Description

 A remote overflow exists in the Squid Internet Object Cache server. Squid fails to correctly test the length of the user-supplied LanMan Hash value in the ntlm_check_auth() function resulting in a stack-based buffer overflow. With a specially crafted request, an attacker can execute arbitrary code on the system with the privileges the Squid process is running under. This flaw can only be exploited if Squid was compiled with the NTLM authentication helper enabled.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified

Solution

 A patch has been released for this vulnerability available from the Squid website. Additionally, Squid can be recompiled to disable NTLM authentication.

Products

University of California San Diego

Squid Internet Object Cache

 2.5-STABLE5
3.0-PRE3-230040720

References

Credit
  • Anonymous - SEC Consult


Direct URL: http://osvdb.org/36218