[ADVISORY] SQUID-2016:9 Multiple Denial of Service issues in ESI Response processing.
Amos Jeffries <[email protected]> Mon, 9 May 2016 20:25:41 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <465d0707-f819-db65-5fb0-bd189526a481__7791.33841065249$1462783032$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTY6OQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxNjo5 CkRhdGU6ICAgICAgICAgICAgICAgTWF5IDA2LCAyMDE2ClN1bW1hcnk6ICAgICAgICAgICAgTXVs dGlwbGUgRGVuaWFsIG9mIFNlcnZpY2UgaXNzdWVzCiAgICAgICAgICAgICAgICAgICAgaW4gRVNJ IFJlc3BvbnNlIHByb2Nlc3NpbmcuCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMy54IC0+IDMu NS4xNwogICAgICAgICAgICAgICAgICAgIFNxdWlkIDQueCAtPiA0LjAuOQpGaXhlZCBpbiB2ZXJz aW9uOiAgIFNxdWlkIDQuMC4xMCwgMy41LjE4Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKICAgIGh0dHA6Ly93d3cuc3F1 aWQtY2FjaGUub3JnL0Fkdmlzb3JpZXMvU1FVSUQtMjAxNl85LnR4dAogICAgaHR0cDovL2N2ZS5t aXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDE2LTQ1NTUKICAgIGh0dHA6 Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxNi00NTU2Cl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlvbjoKCiBEdWUgdG8gaW5jb3JyZWN0IHBvaW50ZXIg aGFuZGxpbmcgYW5kIHJlZmVyZW5jZSBjb3VudGluZyBTcXVpZCBpcwogdnVsbmVyYWJsZSB0byBh IGRlbmlhbCBvZiBzZXJ2aWNlIGF0dGFjayB3aGVuIHByb2Nlc3NpbmcgRVNJCiByZXNwb25zZXMu CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KClNldmVyaXR5OgoKIFRoZXNlIHByb2JsZW1zIGFsbG93IGEgcmVtb3RlIHNl cnZlciBkZWxpdmVyaW5nIGNlcnRhaW4gRVNJCiByZXNwb25zZSBzeW50YXggdG8gdHJpZ2dlciBh IGRlbmlhbCBvZiBzZXJ2aWNlIGZvciBhbGwgY2xpZW50cwogYWNjZXNzaW5nIHRoZSBTcXVpZCBz ZXJ2aWNlLgoKIER1ZSB0byB1bnJlbGF0ZWQgY2hhbmdlcyBTcXVpZC0zLjUgaGFzIGJlY29tZSB2 dWxuZXJhYmxlIHRvIHNvbWUKIHJlZ3VsYXIgRVNJIHNlcnZlciByZXNwb25zZXMgYWxzbyB0cmln Z2VyaW5nIG9uZSBvciBtb3JlIG9mIHRoZXNlCiBpc3N1ZXMuCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClVwZGF0ZWQg UGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiAzLjUuMTggYW5k IDQuMC4xMC4KCiBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMgcHJvYmxlbSBm b3IgdGhlIHN0YWJsZQogcmVsZWFzZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZl czoKClNxdWlkIDMuNDoKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92My8z LjQvY2hhbmdlc2V0cy9TUVVJRC0yMDE2XzkucGF0Y2g+CgpTcXVpZCAzLjU6CiA8aHR0cDovL3d3 dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjMvMy41L2NoYW5nZXNldHMvU1FVSUQtMjAxNl85 LnBhdGNoPgoKIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9mIFNxdWlk IHRoZW4gcGxlYXNlIHJlZmVyCiB0byB0aGUgcGFja2FnZSB2ZW5kb3IgZm9yIGF2YWlsYWJpbGl0 eSBpbmZvcm1hdGlvbiBvbiB1cGRhdGVkCiBwYWNrYWdlcy4KCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKRGV0ZXJtaW5p bmcgaWYgeW91ciB2ZXJzaW9uIGlzIHZ1bG5lcmFibGU6CgogQWxsIFNxdWlkLTIueCBhcmUgbm90 IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkIGJ1aWx0IHdpdGggLS1kaXNhYmxlLWVzaSBhcmUgbm90 IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMuMCB2ZXJzaW9ucyBidWlsdCB3aXRob3V0IC0tZW5h YmxlLWVzaSBhcmUgbm90CiB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjAgdmVyc2lvbnMgYnVp bHQgd2l0aCAtLWVuYWJsZS1lc2kgYW5kIHVzZWQgZm9yCiByZXZlcnNlLXByb3h5IGFyZSB2dWxu ZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjEgYW5kIGxhdGVyIHZlcnNpb25zIHVwIHRvIGFuZCBpbmNs dWRpbmcKIFNxdWlkLTMuNS4xNyBiZWluZyB1c2VkIGZvciByZXZlcnNlLXByb3h5IGFyZSB2dWxu ZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjEgYW5kIGxhdGVyIHZlcnNpb25zIHVwIHRvIGFuZCBpbmNs dWRpbmcKIFNxdWlkLTMuNS4xNyBiZWluZyB1c2VkIGZvciBUTFMgLyBIVFRQUyBpbnRlcmNlcHRp b24gYXJlCiB2dWxuZXJhYmxlLgoKIEFsbCB1bnBhdGNoZWQgU3F1aWQtNC4wIHVwIHRvIGFuZCBp bmNsdWRpbmcgU3F1aWQtNC4wLjkKIGJlaW5nIHVzZWQgYXMgcmV2ZXJzZS1wcm94eSBhcmUgdnVs bmVyYWJsZS4KCiBBbGwgdW5wYXRjaGVkIFNxdWlkLTQuMCB1cCB0byBhbmQgaW5jbHVkaW5nIFNx dWlkLTQuMC45CiBiZWluZyB1c2VkIGFzIFRMUy9IVFRQUyBpbnRlcmNlcHQgcHJveHkgYXJlIHZ1 bG5lcmFibGUuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KCldvcmthcm91bmQ6CgogQnVpbGQgU3F1aWQgd2l0aCAtLWRp c2FibGUtZXNpCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3IgdGhlIFNxdWlkIHByb2pl Y3Q6CgogRm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBvbiBiaW5hcnkgcGFja2Fn ZWQgdmVyc2lvbnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRhY3Qgc2hvdWxk IGJlIHlvdXIgYmluYXJ5CiBwYWNrYWdlIHZlbmRvci4KCiBJZiB5b3VyIGluc3RhbGwgYW5kIGJ1 aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlkIHNvdXJjZXMKIHRoZW4gdGhlIHNxdWlk LXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QgaXMgeW91cgogcHJpbWFy eSBzdXBwb3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMgc2VlCiA8aHR0cDovL3d3 dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0bWw+LgoKIEZvciByZXBv cnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBTVEFCTEUgcmVsZWFzZQog dGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2VkCiA8aHR0cDovL2J1Z3Mu c3F1aWQtY2FjaGUub3JnLz4uCgogRm9yIHJlcG9ydGluZyBvZiBzZWN1cml0eSBzZW5zaXRpdmUg YnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogc3F1aWQtYnVnc0BsaXN0cy5zcXVpZC1jYWNoZS5v cmcgbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiBsaXN0ICh0aG91Z2ggYW55b25lIGNhbiBw b3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cwogYXJlIHRyZWF0ZWQgaW4gY29u ZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlzaGVkLgoKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f CgpDcmVkaXRzOgoKIFRoZSBpbml0aWFsIGlzc3VlIHdhcyByZXBvcnRlZCBieSAiYmZlay0xOCIu CgogQWRkaXRpb25hbCBpc3N1ZXMgYW5kIGF0dGFjayB2ZWN0b3Igd2FzIHJlcG9ydGVkIGJ5ICJA dmZ0YWJsZSIuCgogRml4ZWQgYnkgQW1vcyBKZWZmcmllcyBmcm9tIFRyZWVob3VzZSBOZXR3b3Jr cyBMdGQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KClJldmlzaW9uIGhpc3Rvcnk6CgogMjAxNi0wMy0wMiAxNToxMjox MiBVVEMgSW5pdGlhbCBSZXBvcnQKIDIwMTYtMDUtMDEgMjM6NDg6MjcgVVRDIEFkZGl0aW9uYWwg SXNzdWUgUmVwb3J0CiAyMDE2LTA1LTA2IDA5OjM5OjQ4IFVUQyBQYXRjaGVzIFJlbGVhc2VkCiAy MDE2LTA1LTA2IDEzOjEyOjAwIFVUQyBQYWNrYWdlcyBSZWxlYXNlZAogMjAxNi0wNS0wNiAxNDo0 Njo0MSBVVEMgQ1ZFIEFzc2lnbm1lbnQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QK c3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1j YWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK