oss-security - CVE-Request: squid pinger remote DoS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 9 Sep 2014 10:53:51 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE-Request: squid pinger remote DoS

Hi

I made a fix for squid 3.4.6 and request a CVE for
this issue:

The pinger code that checks for nodes being alive doesnt
properly validate ICMP and ICMPv6 replies, in particular
icmp6 types which are used to index into a string array.
This could cause crashes when the index is OOB.

A patch is available here:

https://bugzilla.novell.com/show_bug.cgi?id=891268

I also made some cleanups and error checking on the
receive socket.

I am not deep into the overall squid architecture so
I dont know what happens to squid itself when the
pinger sub-process crashes (think SIGPIPE etc). But to me
it looks like you can only DoS the pinger sub-system,
not the whole squid.

Sebastian

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.