Bug 22440 - squid new security issues SQUID-2018:1 (CVE-2018-1000024) and SQUID-2018:2 (CVE-2018-1000027)
Summary: squid new security issues SQUID-2018:1 (CVE-2018-1000024) and SQUID-2018:2 (C...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA5-64-OK MGA6-64-OK MGA5-32-OK
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2018-01-22 14:18 CET by David Walser
Modified: 2018-01-30 03:13 CET (History)
3 users (show)

See Also:
Source RPM: squid-3.5.26-1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2018-01-22 14:18:48 CET
Upstream has issued advisories today (January 22):
http://www.squid-cache.org/Advisories/SQUID-2018_1.txt
http://www.squid-cache.org/Advisories/SQUID-2018_2.txt

CVEs have been requested but not yet assigned.

Patched packages uploaded for Mageia 5, Mageia 6, and Cauldron.

Premilinary advisory below (pending CVEs).

Advisory:
========================

Updated squid packages fix security vulnerabilities:

Due to incorrect pointer handling Squid is vulnerable to denial of service
attack when processing ESI responses. This problem allows a remote server
delivering certain ESI response syntax to trigger a denial of service for all
clients accessing the Squid service (SQUID-2018:1).

Due to incorrect pointer handling Squid is vulnerable to denial of service
attack when processing ESI responses or downloading intermediate CA
certificates. This problem allows a remote client delivering certain HTTP
requests in conjunction with certain trusted server responses to trigger a
denial of service for all clients accessing the Squid service (SQUID-2018:2).

References:
http://www.squid-cache.org/Advisories/SQUID-2018_1.txt
http://www.squid-cache.org/Advisories/SQUID-2018_2.txt
========================

Updated packages in core/updates_testing:
========================
squid-3.5.23-1.1.mga5
squid-cachemgr-3.5.23-1.1.mga5
squid-3.5.26-1.1.mga6
squid-cachemgr-3.5.26-1.1.mga6

from SRPMS:
squid-3.5.23-1.1.mga5.src.rpm
squid-3.5.26-1.1.mga6.src.rpm
Comment 1 David Walser 2018-01-22 14:19:04 CET
Testing hints:
https://bugs.mageia.org/show_bug.cgi?id=14004#c3
https://bugs.mageia.org/show_bug.cgi?id=16304#c14

Keywords: (none) => has_procedure
Whiteboard: (none) => MGA5TOO

Comment 2 David Walser 2018-01-23 04:41:10 CET
Posting this through an updated Squid on Mageia 5 x86_64.

Whiteboard: MGA5TOO => MGA5TOO MGA5-64-OK

Comment 3 Herman Viaene 2018-01-23 12:21:01 CET
MGA5-32 on Dell Latitude D600 Xfce
No installation issues
I must be missing something
Installed squid
checked httpd is running
started squid
imported squid.conf from bug 16304
restarte5 squid
Changed proxy settings in Firefox
Surfing to https://www.magei.org gives me "The proxyserver refuses connection".

CC: (none) => herman.viaene

Comment 4 David Walser 2018-01-23 14:57:44 CET
Don't use a squid.conf from an older Squid version.  The one shipped with the package should work just fine.
Comment 5 Herman Viaene 2018-01-23 15:34:58 CET
I had the same problem with the default squid.conf, that's why I started hunting for more info.
Comment 6 David Walser 2018-01-23 15:49:58 CET
Did you start the service?
Comment 7 Herman Viaene 2018-01-23 16:11:38 CET
Please David, read my Comment 3
Comment 8 David Walser 2018-01-23 18:16:40 CET
You didn't give enough information for us to know what you did or to help diagnose it.
Comment 9 Len Lawrence 2018-01-23 19:36:47 CET
I have been trying this for Mageia 6 x86_64 and have hit similar problems.  The 'refusing connection' message comes up only when squid is stopped.  When it is enabled all sites time out.  The only difference between the default config and the downloaded one is the line:
http_access deny to_localhost
which is commented out in the default.
Switching back to the default makes no difference.
After configuring the proxy settings in firefox restarted squid.

Shorewall has ports 3128/tcp and 3128/udp enabled
Oops - forgot to restart apache!  Done that and restarted squid.

firefox settings are:
manual configuration -> localhost|127.0.0.1 -> port 3128

All internet connections time out.

CC: (none) => tarazed25

Comment 10 David Walser 2018-01-23 19:49:55 CET
It should say refusing connections when Squid is stopped.  It works when it's running, right?
Comment 11 Len Lawrence 2018-01-23 19:52:53 CET
Yes, correct.
A slight advance, maybe.  Went back into firefox and tried to wipe all the other settings, leaving just the manual ones.  Switched from SOCKS v5 to SOCKS 4 (no idea what that means) but the SOCKS entry is blank.  After that restarting squid allowed access to the internet.
Comment 12 David Walser 2018-01-23 21:48:29 CET
Cool, it's working then.  The SOCKS entry should indeed be blank.
Comment 13 Len Lawrence 2018-01-24 00:05:28 CET
Thanks David.  So that is all that is needed?

And, @Herman.  Anything there which helps you?
Comment 14 David Walser 2018-01-24 00:47:00 CET
Yes, if it works, it should be fine.
Len Lawrence 2018-01-24 00:54:05 CET

Whiteboard: MGA5TOO MGA5-64-OK => MGA5TOO MGA5-64-OK MGA6-64-OK

Comment 15 Herman Viaene 2018-01-24 09:01:33 CET
Booted this morning. Squid and httpd running, gives "The proxyserver refuses connection" (or whatever it might be in english, I am running dutch)
Stopped squid, reinstated its original squid.conf, started squid again, still same message.
Cleared the socks entry as Comment 11, refreshed the https page and now it comes thru.
Then browsed to http://localhost/cgi-bin/cachemgr.cgi, all looks OK

Whiteboard: MGA5TOO MGA5-64-OK MGA6-64-OK => MGA5TOO MGA5-64-OK MGA6-64-OK MGA5-32-OK

Lewis Smith 2018-01-24 21:22:07 CET

Keywords: (none) => advisory, validated_update
CC: (none) => sysadmin-bugs

Comment 16 Mageia Robot 2018-01-24 23:38:53 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0095.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 17 David Walser 2018-01-30 03:13:16 CET
CVE-2018-1000024 and CVE-2018-1000027 have been assigned:
http://openwall.com/lists/oss-security/2018/01/29/1
http://openwall.com/lists/oss-security/2018/01/29/2

Summary: squid new security issues SQUID-2018:1 and SQUID-2018:2 => squid new security issues SQUID-2018:1 (CVE-2018-1000024) and SQUID-2018:2 (CVE-2018-1000027)


Note You need to log in before you can comment on or make changes to this bug.