[ADVISORY] SQUID-2016:10 - Information disclosure in Collapsed Forwarding
Amos Jeffries <[email protected]> Sun, 18 Dec 2016 05:04:19 +1300
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <81d5db94-2b35-c178-4d3c-b8413a2e1999__20032.9562569552$1481995192$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTY6MTAKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgIFNRVUlELTIwMTY6 MTAKRGF0ZTogICAgICAgICAgICAgICBEZWMgMTYsIDIwMTYKU3VtbWFyeTogICAgICAgICAgICBJ bmZvcm1hdGlvbiBkaXNjbG9zdXJlCiAgICAgICAgICAgICAgICAgICAgaW4gQ29sbGFwc2VkIEZv cndhcmRpbmcuCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgMy41IC0+IDMuNS4yMgogICAgICAg ICAgICAgICAgICAgIFNxdWlkIDQuMCAtPiA0LjAuMTYKRml4ZWQgaW4gdmVyc2lvbjogICBTcXVp ZCA0LjAuMTcsIDMuNS4yMwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9y Zy9BZHZpc29yaWVzL1NRVUlELTIwMTZfMTAudHh0Cl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlw dGlvbjoKCiBEdWUgdG8gaW5jb3JyZWN0IGNvbXBhcnNpb24gb2YgcmVxdWVzdCBoZWFkZXJzIFNx dWlkIGNhbiBkZWxpdmVyCiByZXNwb25zZXMgY29udGFpbmluZyBwcml2YXRlIGRhdGEgdG8gY2xp ZW50cyBpdCBzaG91bGQgbm90IGhhdmUKIHJlYWNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClNldmVyaXR5OgoK IFRoaXMgcHJvYmxlbSBhbGxvd3MgYSByZW1vdGUgYXR0YWNrZXIgdG8gZGlzY292ZXIgcHJpdmF0 ZSBhbmQKIHNlbnNpdGl2ZSBpbmZvcm1hdGlvbiBhYm91dCBhbm90aGVyIGNsaWVudHMgYnJvd3Np bmcgc2Vzc2lvbi4KIFBvdGVudGlhbGx5IGluY2x1ZGluZyBjcmVkZW50aWFscyB3aGljaCBhbGxv dyBhY2Nlc3MgdG8gZnVydGhlcgogc2Vuc2l0aXZlIHJlc291cmNlcy4KCiBUaGlzIHByb2JsZW0g b25seSBhZmZlY3RzIFNxdWlkIGNvbmZpZ3VyZWQgdG8gdXNlIHRoZSBDb2xsYXBzZWQKIEZvcndh cmRpbmcgZmVhdHVyZS4KCiBJdCBpcyBvZiBwYXJ0aWN1bGFyIGltcG9ydGFuY2UgZm9yIEhUVFBT IHJldmVyc2UtcHJveHkgc2l0ZXMKIHdpdGggQ29sbGFwc2VkIEZvcndhcmRpbmcuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lv biAzLjUuMjMgYW5kIDQuMC4xNy4KCiBJbiBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRo aXMgcHJvYmxlbSBjYW4gYmUgZm91bmQgaW4gb3VyCiBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDMu NSAoZXhjbHVkaW5nIDMuNS4yMik6CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lv bnMvdjMvMy41L2NoYW5nZXNldHMvU1FVSUQtMjAxNl8xMF9hLnBhdGNoPgoKU3F1aWQgMy41LjIy OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25zL3YzLzMuNS9jaGFuZ2VzZXRz L3NxdWlkLTMuNS0xNDEyNy5wYXRjaD4KClNxdWlkIDQuMDoKIDxodHRwOi8vd3d3LnNxdWlkLWNh Y2hlLm9yZy9WZXJzaW9ucy92NC9jaGFuZ2VzZXRzL3NxdWlkLTQtMTQ5NTYucGF0Y2g+CgogSWYg eW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2Ug cmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9u IG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZl cnNpb24gaXMgdnVsbmVyYWJsZToKCiBTcXVpZC0yLnggaGF2ZSBub3QgYmVlbiB0ZXN0ZWQuCgoK IFRoZSBmb2xsb3dpbmcgY29tbWFuZCBjYW4gYmUgdXNlZCB0byBkZXRlcm1pbmUgaWYgU3F1aWQt MyBvcgogbGF0ZXIgaGF2ZSBjb2xsYXBzZWRfZm9yd2FyZGluZyBpbiBzcXVpZC5jb25mOgoKICAo c3F1aWQgLWsgcGFyc2UgMj4mMSkgfCBncmVwIGNvbGxhcHNlZF9mb3J3YXJkaW5nCgoKIEFsbCBT cXVpZC0zLnggdmVyc2lvbnMgd2l0aG91dCBjb2xsYXBzZWRfZm9yd2FyZGluZyBjb25maWd1cmVk CiBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMuNSB2ZXJzaW9ucyB3aXRoICdjb2xs YXBzZWRfZm9yd2FyZGluZyBvZmYnCiBjb25maWd1cmVkIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBB bGwgU3F1aWQtMy41IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgU3F1aWQtMy41LjIyIHdp dGgKICdjb2xsYXBzZWRfZm9yd2FyZGluZyBvbicgY29uZmlndXJlZCBhcmUgdnVsbmVyYWJsZS4K CiBBbGwgU3F1aWQtNC4wIHZlcnNpb25zIHdpdGhvdXQgY29sbGFwc2VkX2ZvcndhcmRpbmcgY29u ZmlndXJlZAogYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC00LjAgdmVyc2lvbnMgd2l0 aCAnY29sbGFwc2VkX2ZvcndhcmRpbmcgb2ZmJwogY29uZmlndXJlZCBhcmUgbm90IHZ1bG5lcmFi bGUuCgogQWxsIFNxdWlkLTQuMCB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nIFNxdWlkLTQu MC4xNiB3aXRoCiAnY29sbGFwc2VkX2ZvcndhcmRpbmcgb24nIGNvbmZpZ3VyZWQgYXJlIHZ1bG5l cmFibGUuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KCldvcmthcm91bmQ6CgogUmVtb3ZlIGFsbCB1c2VzIG9mICdjb2xs YXBzZWRfZm9yd2FyZGluZycgZnJvbSBzcXVpZC5jb25mIGFuZAogaW5jbHVkZWQgc3ViLWZpbGVz LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCgpDb250YWN0IGRldGFpbHMgZm9yIHRoZSBTcXVpZCBwcm9qZWN0OgoKIEZv ciBpbnN0YWxsYXRpb24gLyB1cGdyYWRlIHN1cHBvcnQgb24gYmluYXJ5IHBhY2thZ2VkIHZlcnNp b25zCiBvZiBTcXVpZDogWW91ciBmaXJzdCBwb2ludCBvZiBjb250YWN0IHNob3VsZCBiZSB5b3Vy IGJpbmFyeQogcGFja2FnZSB2ZW5kb3IuCgogSWYgeW91ciBpbnN0YWxsIGFuZCBidWlsZCBTcXVp ZCBmcm9tIHRoZSBvcmlnaW5hbCBTcXVpZCBzb3VyY2VzCiB0aGVuIHRoZSBzcXVpZC11c2Vyc0Bs aXN0cy5zcXVpZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0IGlzIHlvdXIKIHByaW1hcnkgc3VwcG9y dCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNlZQogPGh0dHA6Ly93d3cuc3F1aWQt Y2FjaGUub3JnL1N1cHBvcnQvbWFpbGluZy1saXN0cy5odG1sPi4KCiBGb3IgcmVwb3J0aW5nIG9m IG5vbi1zZWN1cml0eSBidWdzIGluIHRoZSBsYXRlc3QgU1RBQkxFIHJlbGVhc2UKIHRoZSBzcXVp ZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNlZAogPGh0dHA6Ly9idWdzLnNxdWlkLWNh Y2hlLm9yZy8+LgoKIEZvciByZXBvcnRpbmcgb2Ygc2VjdXJpdHkgc2Vuc2l0aXZlIGJ1Z3Mgc2Vu ZCBhbiBlbWFpbCB0byB0aGUKIHNxdWlkLWJ1Z3NAbGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxp bmcgbGlzdC4gSXQncyBhIGNsb3NlZAogbGlzdCAodGhvdWdoIGFueW9uZSBjYW4gcG9zdCkgYW5k IHNlY3VyaXR5IHJlbGF0ZWQgYnVnIHJlcG9ydHMKIGFyZSB0cmVhdGVkIGluIGNvbmZpZGVuY2Ug dW50aWwgdGhlIGltcGFjdCBoYXMgYmVlbiBlc3RhYmxpc2hlZC4KCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ3JlZGl0 czoKCiBUaGlzIGlzc3VlIHdhcyByZXBvcnRlZCBieSBGZWxpeCBIYXNzZXJ0IGZyb20gU2V2ZW52 YWwKIFRlY2hub2xvZ2llcyBHbWJILgoKIEZpeGVkIGJ5IEVkdWFyZCBCYWdkYXNhcnlhbiBmcm9t IE1lYXN1cmVtZW50IEZhY3RvcnkuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClJldmlzaW9uIGhpc3Rvcnk6CgogMjAx Ni0xMS0yOCAxNzoyODo0MyBVVEMgSW5pdGlhbCBSZXBvcnQKIDIwMTYtMTItMTYgMTg6Mzc6MDAg VVRDIFBhY2thZ2VzIFJlbGVhc2VkCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpFTkQKCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxpbmcgbGlzdApz cXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3RzLnNxdWlkLWNh Y2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=