[ADVISORY] SQUID-2018:2 Denial of Service issue in HTTP Message processing

Amos Jeffries <[email protected]> Sun, 21 Jan 2018 20:52:24 +1300
Newsgroups gmane.comp.web.squid.announce
Message-ID <4e307c39-d1c1-eaca-2ce4-96a32892ccd5__15703.9074147635$1516610026$gmane$org@treenet.co.nz>
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fCgogICAgIFNxdWlkIFByb3h5IENhY2hlIFNlY3VyaXR5IFVwZGF0ZSBBZHZpc29y
eSBTUVVJRC0yMDE4OjIKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fCgpBZHZpc29yeSBJRDogICAgICAgIFNRVUlELTIwMTg6
MgpEYXRlOiAgICAgICAgICAgICAgIEphbiAxOSwgMjAxOApTdW1tYXJ5OiAgICAgICAgICAgIERl
bmlhbCBvZiBTZXJ2aWNlIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgIGluIEhUVFAgTWVzc2Fn
ZSBwcm9jZXNzaW5nLgpBZmZlY3RlZCB2ZXJzaW9uczogIFNxdWlkIDMueCAtPiAzLjUuMjcKICAg
ICAgICAgICAgICAgICAgICAgU3F1aWQgNC54IC0+IDQuMC4yMgpGaXhlZCBpbiB2ZXJzaW9uOiAg
IFNxdWlkIDQuMC4yMwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX18KCiAgICAgaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcv
QWR2aXNvcmllcy9TUVVJRC0yMDE4XzIudHh0Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlv
bjoKCiAgRHVlIHRvIGluY29ycmVjdCBwb2ludGVyIGhhbmRsaW5nIFNxdWlkIGlzIHZ1bG5lcmFi
bGUgdG8gZGVuaWFsCiAgb2Ygc2VydmljZSBhdHRhY2sgd2hlbiBwcm9jZXNzaW5nIEVTSSByZXNw
b25zZXMgb3IgZG93bmxvYWRpbmcKICBpbnRlcm1lZGlhdGUgQ0EgY2VydGlmaWNhdGVzLgoKX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fCgpTZXZlcml0eToKCiAgVGhpcyBwcm9ibGVtIGFsbG93cyBhIHJlbW90ZSBjbGllbnQg
ZGVsaXZlcmluZyBjZXJ0YWluIEhUVFAKICByZXF1ZXN0cyBpbiBjb25qdW5jdGlvbiB3aXRoIGNl
cnRhaW4gdHJ1c3RlZCBzZXJ2ZXIgcmVzcG9uc2VzIHRvCiAgdHJpZ2dlciBhIGRlbmlhbCBvZiBz
ZXJ2aWNlIGZvciBhbGwgY2xpZW50cyBhY2Nlc3NpbmcgdGhlIFNxdWlkCiAgc2VydmljZS4KCl9f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fXwoKVXBkYXRlZCBQYWNrYWdlczoKCiAgVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQg
dmVyc2lvbiA0LjAuMjMuCgogIEluIGFkZGl0aW9uLCBwYXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBw
cm9ibGVtIGZvciB0aGUgc3RhYmxlCiAgcmVsZWFzZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRj
aCBhcmNoaXZlczoKClNxdWlkIDMuNToKICA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVy
c2lvbnMvdjMvMy41L2NoYW5nZXNldHMvU1FVSUQtMjAxOF8yLnBhdGNoPgoKU3F1aWQgNDoKICA8
aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9TUVVJRC0y
MDE4XzIucGF0Y2g+CgogIElmIHlvdSBhcmUgdXNpbmcgYSBwcmVwYWNrYWdlZCB2ZXJzaW9uIG9m
IFNxdWlkIHRoZW4gcGxlYXNlIHJlZmVyCiAgdG8gdGhlIHBhY2thZ2UgdmVuZG9yIGZvciBhdmFp
bGFiaWxpdHkgaW5mb3JtYXRpb24gb24gdXBkYXRlZAogIHBhY2thZ2VzLgoKX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpE
ZXRlcm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiAgQWxsIFNxdWlkIGNv
bmZpZ3VyZWQgd2l0aCAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9mZiIgYXJlIG5vdAogIHZ1
bG5lcmFibGUuCgogIEFsbCBTcXVpZC0zLjAgdmVyc2lvbnMgYnVpbHQgd2l0aCAtLWVuYWJsZS1l
c2kgYW5kIGJlaW5nIHVzZWQgZm9yCiAgcmV2ZXJzZS1wcm94eSB3aXRoIHNxdWlkLmNvbmYgY29u
dGFpbmluZwogICJsb2dfdXNlc19pbmRpcmVjdF9jbGllbnQgb24iIGFyZSB2dWxuZXJhYmxlLgoK
ICBBbGwgU3F1aWQtMy4xIGFuZCBsYXRlciB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nCiAg
U3F1aWQtMy41LjI3IGJlaW5nIHVzZWQgZm9yIHJldmVyc2UtcHJveHkgd2l0aCBzcXVpZC5jb25m
CiAgY29udGFpbmluZyAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9uIiBhcmUgdnVsbmVyYWJs
ZS4KCiAgQWxsIFNxdWlkLTQgdXAgdG8gYW5kIGluY2x1ZGluZyBTcXVpZC00LjAuMjIgYmVpbmcg
dXNlZCBmb3IKICByZXZlcnNlLXByb3h5IHdpdGggc3F1aWQuY29uZiBjb250YWluaW5nCiAgImxv
Z191c2VzX2luZGlyZWN0X2NsaWVudCBvbiIgYXJlIHZ1bG5lcmFibGUuCgogIEFsbCB1bnBhdGNo
ZWQgU3F1aWQtNCB1cCB0byBhbmQgaW5jbHVkaW5nIFNxdWlkLTQuMC4yMiBiZWluZwogIHVzZWQg
Zm9yIFRMUy9IVFRQUyBpbnRlcmNlcHQgcHJveHkgd2l0aCBzcXVpZC5jb25mIGNvbnRhaW5pbmcK
ICAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9uIiBhcmUgdnVsbmVyYWJsZS4KCl9fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
XwoKV29ya2Fyb3VuZHM6CgogIENvbmZpZ3VyZSAibG9nX3VzZXNfaW5kaXJlY3RfY2xpZW50IG9m
ZiIgaW4gc3F1aWQuY29uZgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDb250YWN0IGRldGFpbHMgZm9yIHRoZSBTcXVp
ZCBwcm9qZWN0OgoKICBGb3IgaW5zdGFsbGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFy
eSBwYWNrYWdlZCB2ZXJzaW9ucwogIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9mIGNvbnRh
Y3Qgc2hvdWxkIGJlIHlvdXIgYmluYXJ5CiAgcGFja2FnZSB2ZW5kb3IuCgogIElmIHlvdXIgaW5z
dGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogIHRo
ZW4gdGhlIHNxdWlkLXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QgaXMg
eW91cgogIHByaW1hcnkgc3VwcG9ydCBwb2ludC4gRm9yIHN1YnNjcmlwdGlvbiBkZXRhaWxzIHNl
ZQogIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRt
bD4uCgogIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBT
VEFCTEUgcmVsZWFzZQogIHRoZSBzcXVpZCBidWd6aWxsYSBkYXRhYmFzZSBzaG91bGQgYmUgdXNl
ZAogIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiAgRm9yIHJlcG9ydGluZyBvZiBz
ZWN1cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogIHNxdWlkLWJ1Z3NA
bGlzdHMuc3F1aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdC4gSXQncyBhIGNsb3NlZAogIGxpc3Qg
KHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1ZyByZXBvcnRz
CiAgYXJlIHRyZWF0ZWQgaW4gY29uZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVz
dGFibGlzaGVkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fCgpDcmVkaXRzOgoKICBUaGUgaW5pdGlhbCBpc3N1ZSB3YXMg
cmVwb3J0ZWQgYnkgTG91aXMgRGlvbi1NYXJjaWwgb24gYmVoYWxmIG9mCiAgR29TZWN1cmUuCgog
IEZpeGVkIGJ5IEFtb3MgSmVmZnJpZXMgZnJvbSBUcmVlaG91c2UgTmV0d29ya3MgTHRkLgoKX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKICAyMDE3LTEyLTEzIDIwOjA5OjMwIFVUQyBJbml0
aWFsIFJlcG9ydAogIDIwMTgtMDEtMTggMjM6MTA6MDAgVVRDIFBhdGNoZXMgUmVsZWFzZWQKICAy
MDE4LTAxLTIxIDA3OjQ1OjAwIFVUQyBBZHZpc29yeSBhbmQgZml4ZWQgcGFja2FnZXMgcmVsZWFz
ZWQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMu
c3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1
aWQtYW5ub3VuY2UK