squidGuard Multiple Security Bypass Vulnerabilities

Bugtraq ID:	36800
Class:	Input Validation Error
CVE:	CVE-2009-3700 CVE-2009-3826
Remote:	Yes
Local:	No
Published:	Oct 23 2009 12:00AM
Updated:	Apr 16 2015 05:50PM
Credit:	The vendor reported these issues.
Vulnerable:	SuSE openSUSE 11.3 squidGuard squidGuard 1.4 squidGuard squidGuard 1.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

squidGuard Multiple Security Bypass Vulnerabilities

squidGuard is prone to multiple security-bypass vulnerabilities.

Attackers can leverage these issues to bypass certain security restrictions such as URI filters and perform unauthorized actions.

squidGuard 1.3 and 1.4 are vulnerable; prior versions may also be affected.

squidGuard Multiple Security Bypass Vulnerabilities

Attackers can use standard tools to exploit these issues.

squidGuard Multiple Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian squidguard_1.2.0-8.4+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_ia64.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva squidGuard-1.4-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva squidGuard-1.4-0.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 alpha

• Debian squidguard_1.2.0-8.4+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_alpha.deb

squidGuard squidGuard 1.4

• squidGuard squidGuard-1.4-patch-20091015.tar.gz
  http://www.squidguard.org/Downloads/Patches/1.4/squidGuard-1.4-patch-2 0091015.tar.gz


• squidGuard squidGuard-1.4-patch-20091019.tar.gz
  http://www.squidguard.org/Downloads/Patches/1.4/squidGuard-1.4-patch-2 0091019.tar.gz

Debian Linux 5.0 ia-32

• Debian squidguard_1.2.0-8.4+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_i386.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva squidGuard-1.2.0-14.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva squidGuard-1.4-0.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian squidguard_1.2.0-8.4+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_s390.deb

Mandriva Linux Mandrake 2008.0

• Mandriva squidGuard-1.2.0-14.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mipsel

• Debian squidguard_1.2.0-8.4+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_mipsel.deb

Debian Linux 5.0 hppa

• Debian squidguard_1.2.0-8.4+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_hppa.deb

Mandriva Linux Mandrake 2009.0

• Mandriva squidGuard-1.3-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 arm

• Debian squidguard_1.2.0-8.4+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_arm.deb

Debian Linux 5.0 armel

• Debian squidguard_1.2.0-8.4+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_armel.deb

MandrakeSoft Corporate Server 4.0

• Mandriva squidGuard-1.2.1-0.1.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva squidGuard-1.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 amd64

• Debian squidguard_1.2.0-8.4+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_amd64.deb

Debian Linux 5.0 mips

• Debian squidguard_1.2.0-8.4+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_mips.deb

Mandriva Linux Mandrake 2009.1

• Mandriva squidGuard-1.4-1.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 powerpc

• Debian squidguard_1.2.0-8.4+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_powerpc.deb

Debian Linux 5.0 sparc

• Debian squidguard_1.2.0-8.4+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/s/squidguard/squidguard_1 .2.0-8.4+lenny1_sparc.deb

MandrakeSoft Multi Network Firewall 2.0

• Mandriva squidGuard-1.2.1-0.1.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva squidGuard-1.2.1-0.1.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva squidGuard-1.2.1-0.1.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva squidGuard-1.2.1-0.1.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

squidGuard Multiple Security Bypass Vulnerabilities

References:

• Patch 20091015 for squidGuard version 1.3 and 1.4 (squidGuard)
  
• Patch 20091019 for squidGuard version 1.4 (squidGuard)
  
• Product Home Page (squidGuard)
  
• squidGuard 1.3 & 1.4 : buffer overflow (majinboo )