Squid Proxy NULL URL Character Unauthorized Access Vulnerability

BID:9778

Info

Squid Proxy NULL URL Character Unauthorized Access Vulnerability

Bugtraq ID: 9778
Class: Input Validation Error
CVE: CVE-2004-0189
Remote: Yes
Local: No
Published: Mar 01 2004 12:00AM
Updated: Jul 12 2009 03:06AM
Credit: Discovery is credited to Mitch Adair.
Vulnerable: Turbolinux Turbolinux Workstation 8.0
Turbolinux Turbolinux Workstation 7.0
Turbolinux Turbolinux Server 8.0
Turbolinux Turbolinux Server 7.0
Turbolinux Appliance Server Workgroup Edition 1.0
Turbolinux Appliance Server Hosting Edition 1.0
Trustix Secure Linux 2.0
Trustix Secure Linux 1.5
Squid Web Proxy Cache 2.5 .STABLE4
+ MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
+ OpenPKG OpenPKG 2.0
+ OpenPKG OpenPKG Current
 Squid Web Proxy Cache 2.5 .STABLE3
+ Mandriva Linux Mandrake 9.2 amd64
 + Mandriva Linux Mandrake 9.2
+ OpenPKG OpenPKG 1.3
+ Redhat Desktop 3.0
+ Redhat Enterprise Linux AS 3
 + Redhat Enterprise Linux ES 3
 + Redhat Enterprise Linux WS 3
 + Redhat Fedora Core1
 + S.u.S.E. Linux Personal 9.0 x86_64
 + S.u.S.E. Linux Personal 9.0
Squid Web Proxy Cache 2.5 .STABLE1
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
+ S.u.S.E. Linux Personal 8.2
Squid Web Proxy Cache 2.4 .STABLE7
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ MandrakeSoft Multi Network Firewall 2.0
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux Advanced Work Station 2.1
Squid Web Proxy Cache 2.4 .STABLE6
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
Squid Web Proxy Cache 2.4 .STABLE2
Squid Web Proxy Cache 2.4
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
Squid Web Proxy Cache 2.3 .STABLE5
Squid Web Proxy Cache 2.3 .STABLE4
Squid Web Proxy Cache 2.1 PATCH2
Squid Web Proxy Cache 2.0 PATCH2
SGI ProPack 3.0
SGI ProPack 2.4
SGI ProPack 2.3
SCO Unixware 7.1.4
SCO Open Server 5.0.7
SCO Open Server 5.0.6
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux ES 2.1
Redhat Enterprise Linux AS 3
Redhat Enterprise Linux AS 2.1
Redhat Advanced Workstation for the Itanium Processor 2.1
Gentoo Linux 1.4 _rc3
Gentoo Linux 1.4 _rc2
Gentoo Linux 1.4 _rc1
Gentoo Linux 1.4
Gentoo Linux 1.2
Gentoo Linux 1.1 a
Gentoo Linux 0.7
Gentoo Linux 0.5
Not Vulnerable: Squid Web Proxy Cache 2.5 .STABLE5
+ S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1
+ Trustix Secure Linux 2.1
+ Trustix Secure Linux 2.0
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32

Discussion

Squid Proxy NULL URL Character Unauthorized Access Vulnerability

It has been reported that Squid Proxy may be prone to an unauthorized access vulnerability that may allow remote users to bypass access controls resulting in unauthorized access to attacker-specified resources. The vulnerability presents itself when a URI that is designed to access a specific location with a supplied username, contains '%00' characters. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI.

Squid Proxy versions 2.0 to 2.5 STABLE4 are reported to be prone to this vulnerability.

Exploit / POC

Squid Proxy NULL URL Character Unauthorized Access Vulnerability

The following proof of concept has been supplied:

http://foo%[email protected]/

Solution / Fix

Squid Proxy NULL URL Character Unauthorized Access Vulnerability

Solution:
The vendor has released version 2.5 STABLE5 to address this issue.

Turbolinux has released an advisory (TLSA-2004-24) and fixes to address this issue. Customers are advised to see the referenced advisory for further details regarding obtaining and applying appropriate fixes.

SGI has released an advisory 20040404-01-U and fixes to address this issue. Please see referenced advisory for further details regarding obtaining and applying appropriate fixes. Fixes are linked below.

Red Hat has released an advisory (RHSA-2004:133-12) and fixes to address this issue on Red Hat Linux Enterprise platforms. Customers who are affected by this issue are advised to apply the appropriate updates. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.

Conectiva have released a security advisory (CLA-2004:838), and updates
to address this issue in Conectiva products. Users are advised to apply
these updates as soon as possible, further details regarding obtaining
and installing these updates can be found in the referenced advisory.

Red Hat has released an advisory (RHSA-2004:134-01) and fixes to address this issue on Red Hat Linux 9 platforms. Customers affected by this issue are advised to apply the appropriate updates. Please see referenced advisory for additional information, fix is linked below.

Gentoo has released advisory GLSA 200403-11 to address this issue. To update the system, enter the following commands:
# emerge sync
# emerge -pv ">=net-www/squid-2.5.5"
# emerge ">=net-www/squid-2.5.5"

Mandrake has released an advisory MDKSA-2004:025 to address this issue. Please see the referenced advisory for more information.

OpenPKG has released an advisory OpenPKG-SA-2004.008 to address this issue in OpenPKG CURRENT, 2.0 and 1.3. Please see the referenced advisory for more information.

Debian has released advisory DSA 474-1 dealing with this issue.

RedHat has released an advisory FEDORA-2004-104 to address this issue in Fedora. Please see the referenced advisory for more information.

Trustix has released an advisory TSL-2004-0019 with fixes to address this issue. Please see the referenced advisory for more information.

SGI has released an advisory (20040506-01-U) with Patch 10075 for SGI
ProPack 3 to address this and other issues. Please see the referenced
advisory for more information.

SCO has released an advisory (SCOSA-2004.13) to address this issue for OpenServer 5.0.6 and 5.0.7. Please see the referenced advisory for further information on obtaining fixes for affected operating systems.

SCO has released an advisory (SCOSA-2005.16) to address this issue in UnixWare 7.1.4. Please see the referenced advisory for further information on obtaining fixes.


Squid Web Proxy Cache 2.0 PATCH2

Squid Web Proxy Cache 2.1 PATCH2

Squid Web Proxy Cache 2.3 .STABLE4

Squid Web Proxy Cache 2.3 .STABLE5

SGI ProPack 2.3

Squid Web Proxy Cache 2.4 .STABLE7

Squid Web Proxy Cache 2.4 .STABLE6

Squid Web Proxy Cache 2.4

Squid Web Proxy Cache 2.4 .STABLE2

SGI ProPack 2.4

Squid Web Proxy Cache 2.5 .STABLE4

Squid Web Proxy Cache 2.5 .STABLE1

Squid Web Proxy Cache 2.5 .STABLE3

SGI ProPack 3.0

SCO Unixware 7.1.4

References

Squid Proxy NULL URL Character Unauthorized Access Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report