[ADVISORY] SQUID-2018:5 Denial of Service issue in SNMP processing

Amos Jeffries <[email protected]> Mon, 29 Oct 2018 05:09:05 +1300
Newsgroups gmane.comp.web.squid.announce
Message-ID <911fa5ae-f7d3-43fb-b452-c09abf73192b__26889.297043863$1540744644$gmane$org@treenet.co.nz>
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5
IFNRVUlELTIwMTg6NQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxODo1
CkRhdGU6ICAgICAgICAgICAgICAgT2N0b2JlciAyOCwgMjAxOApTdW1tYXJ5OiAgICAgICAgICAg
IERlbmlhbCBvZiBTZXJ2aWNlIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgaW4gU05NUCBwcm9j
ZXNzaW5nLgpBZmZlY3RlZCB2ZXJzaW9uczogIFNxdWlkIDMuMi4wLjEwIC0+IDMuNS4yOAogICAg
ICAgICAgICAgICAgICAgIFNxdWlkIDQueCAtPiA0LjMKRml4ZWQgaW4gdmVyc2lvbjogICBTcXVp
ZCA0LjQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fCgogICAgaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvQWR2aXNvcmll
cy9TUVVJRC0yMDE4XzUudHh0Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJvYmxlbSBEZXNjcmlwdGlvbjoKCiBEdWUg
dG8gYSBtZW1vcnkgbGVhayBpbiBTTk1QIHF1ZXJ5IHJlamVjdGlvbiBjb2RlLCBTcXVpZCBpcwog
dnVsbmVyYWJsZSB0byBhIGRlbmlhbCBvZiBzZXJ2aWNlIGF0dGFjay4KCl9fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKU2V2
ZXJpdHk6CgogVGhpcyBwcm9ibGVtIGFsbG93cyBhIHJlbW90ZSBhdHRhY2tlciB0byBjb25zdW1l
IGFsbCBtZW1vcnkKIGF2YWlsYWJsZSB0byB0aGUgU3F1aWQgcHJvY2VzcywgY2F1c2luZyBpdCB0
byBjcmFzaC4KCiBJbiBlbnZpcm9ubWVudHMgd2hlcmUgcGVyLXByb2Nlc3MgbWVtb3J5IHJlc3Ry
aWN0aW9ucyBhcmUgbm90CiBlbmZvcmNlZCBzdHJpY3RseSwgb3IgY29uZmlndXJlZCB0byBsYXJn
ZSB2YWx1ZXMgdGhpcyBtYXkgYWxzbwogYWZmZWN0IG90aGVyIHByb2Nlc3NlcyBvcGVyYXRpbmcg
b24gdGhlIHNhbWUgbWFjaGluZS4gTGVhZGluZyB0bwogYSBtdWNoIHdvcnNlIGRlbmlhbCBvZiBz
ZXJ2aWNlIHNpdHVhdGlvbi4KCiBUaGlzIHByb2JsZW0gaXMgbGltaXRlZCB0byBTcXVpZCBidWls
dCB3aXRoIFNOTVAgc3VwcG9ydCBhbmQKIHJlY2VpdmluZyBTTk1QIHRyYWZmaWMuCgpfX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X18KClVwZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lv
biA0LjQuCgogSW4gYWRkaXRpb24sIHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9y
IHRoZSBzdGFibGUKIHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6
CgpTcXVpZCAzLjU6CiBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9WZXJzaW9ucy92My8zLjUv
Y2hhbmdlc2V0cy9zcXVpZC0zLjUtYmM5Nzg2MTE5ZjA1OGE3NmRkZjA2MjU0MjRiYzMzZDM2NDYw
YjlhMi5wYXRjaAoKU3F1aWQgNDoKIGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNpb25z
L3Y0L2NoYW5nZXNldHMvc3F1aWQtNC05ODNjNWMzNmU1ZjEwOTUxMmVkMWFmMzhhMzI5ZDBiNWQw
OTY3NDk4LnBhdGNoCgogSWYgeW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2Yg
U3F1aWQgdGhlbiBwbGVhc2UgcmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxh
YmlsaXR5IGluZm9ybWF0aW9uIG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRl
cm1pbmluZyBpZiB5b3VyIHZlcnNpb24gaXMgdnVsbmVyYWJsZToKCiBBbGwgU3F1aWQgYnVpbHQg
d2l0aCAtLWRpc2FibGUtc25tcCBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTIueCBh
bmQgb2xkZXIgdmVyc2lvbnMgYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLnggdXAg
dG8gYW5kIGluY2x1ZGluZyAzLjIuMC45IGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQt
My54IHVwIHRvIGFuZCBpbmNsdWRpbmcgMy41LjI4IGNvbmZpZ3VyZWQgd2l0aAogInNubXBfcG9y
dCAwIiBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMueCB1cCB0byBhbmQgaW5jbHVk
aW5nIDMuNS4yOCB3aXRob3V0IHNubXBfcG9ydAogY29uZmlndXJlZCBhcmUgbm90IHZ1bG5lcmFi
bGUuCgogQWxsIFNxdWlkLTMuMi4wLjEwIGFuZCBsYXRlciAzLjIueCB2ZXJzaW9ucyB3aXRoIHNu
bXBfcG9ydAogY29uZmlndXJlZCB0byBhIG5vbi0wIHZhbHVlIGFyZSB2dWxuZXJhYmxlLgoKIEFs
bCBTcXVpZC0zLjMgdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZyAzLjMuMTQgd2l0aCBzbm1w
X3BvcnQKIGNvbmZpZ3VyZWQgdG8gYSBub24tMCB2YWx1ZSBhcmUgdnVsbmVyYWJsZS4KCiBBbGwg
U3F1aWQtMy40IHZlcnNpb25zIHVwIHRvIGFuZCBpbmNsdWRpbmcgMy40LjE0IHdpdGggc25tcF9w
b3J0CiBjb25maWd1cmVkIHRvIGEgbm9uLTAgdmFsdWUgYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNx
dWlkLTMuNSB2ZXJzaW9ucyB1cCB0byBhbmQgaW5jbHVkaW5nIDMuNS4yOCB3aXRoIHNubXBfcG9y
dAogY29uZmlndXJlZCB0byBhIG5vbi0wIHZhbHVlIGFyZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVp
ZC00LnggdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGluZyA0LjMgd2l0aCBzbm1wX3BvcnQKIGNv
bmZpZ3VyZWQgdG8gYSBub24tMCB2YWx1ZSBhcmUgdnVsbmVyYWJsZS4KCgpUbyBkZXRlcm1pbmUg
dGhlIHZlcnNpb24gb2YgeW91ciBTcXVpZCBhbmQgaXRzIGJ1aWxkIG9wdGlvbnMgdXNlCnRoZSBj
b21tYW5kOgoKIHNxdWlkIC12CgpUbyBkZXRlcm1pbmUgd2hldGhlciBzbm1wX3BvcnQgaXMgY29u
ZmlndXJlZCB1c2UgdGhlIGNvbW1hbmQ6Cgogc3F1aWQgLWsgcGFyc2UgfCBncmVwIHNubXBfcG9y
dAoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fCgpXb3JrYXJvdW5kczoKCkVpdGhlcjsKCiBFbmFibGUgZmlyZXdhbGwgaW5z
cGVjdGlvbiBvZiBTTk1QIHBhY2tldHMgdG8gZW5mb3JjZSBibG9ja2luZwogb2YgYW55IG5vbi1w
ZXJtaXR0ZWQgcGFja2V0cyBwcmlvciB0byB0aGVpciBhcnJpdmluZyBhdCBTcXVpZC4KCiBUaGlz
IHJlc3RyaWN0aW9uIG9mIHBhY2tldCBzb3VyY2VzIHJlZHVjZXMgdGhlIHJpc2ssIGJ1dCBkb2Vz
IG5vdAogY29tcGxldGVseSByZW1vdmUgdGhlIHZ1bG5lcmFiaWxpdHkuCgpPciwKCiBSZW1vdmUg
c25tcF9wb3J0IGFuZCByZWxhdGVkIGNvbmZpZ3VyYXRpb24gc2V0dGluZ3MgdW50aWwgU3F1aWQK
IGNhbiBiZSB1cGdyYWRlZCB0byBhIGZpeGVkIGJ1aWxkLgoKIFRoaXMgY29tcGxldGVseSByZW1v
dmVzIHRoZSB2dWxuZXJhYmlsaXR5IGF0IGNvc3Qgb2YgcmVkdWNlZAogbWFuYWdlbWVudCBhbmQg
bW9uaXRvcmluZyBjYXBhYmlsaXRpZXMuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNvbnRhY3QgZGV0YWlscyBmb3Ig
dGhlIFNxdWlkIHByb2plY3Q6CgogRm9yIGluc3RhbGxhdGlvbiAvIHVwZ3JhZGUgc3VwcG9ydCBv
biBiaW5hcnkgcGFja2FnZWQgdmVyc2lvbnMKIG9mIFNxdWlkOiBZb3VyIGZpcnN0IHBvaW50IG9m
IGNvbnRhY3Qgc2hvdWxkIGJlIHlvdXIgYmluYXJ5CiBwYWNrYWdlIHZlbmRvci4KCiBJZiB5b3Vy
IGluc3RhbGwgYW5kIGJ1aWxkIFNxdWlkIGZyb20gdGhlIG9yaWdpbmFsIFNxdWlkIHNvdXJjZXMK
IHRoZW4gdGhlIHNxdWlkLXVzZXJzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3Qg
aXMgeW91cgogcHJpbWFyeSBzdXBwb3J0IHBvaW50LiBGb3Igc3Vic2NyaXB0aW9uIGRldGFpbHMg
c2VlCiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvU3VwcG9ydC9tYWlsaW5nLWxpc3RzLmh0
bWw+LgoKIEZvciByZXBvcnRpbmcgb2Ygbm9uLXNlY3VyaXR5IGJ1Z3MgaW4gdGhlIGxhdGVzdCBT
VEFCTEUgcmVsZWFzZQogdGhlIHNxdWlkIGJ1Z3ppbGxhIGRhdGFiYXNlIHNob3VsZCBiZSB1c2Vk
CiA8aHR0cDovL2J1Z3Muc3F1aWQtY2FjaGUub3JnLz4uCgogRm9yIHJlcG9ydGluZyBvZiBzZWN1
cml0eSBzZW5zaXRpdmUgYnVncyBzZW5kIGFuIGVtYWlsIHRvIHRoZQogc3F1aWQtYnVnc0BsaXN0
cy5zcXVpZC1jYWNoZS5vcmcgbWFpbGluZyBsaXN0LiBJdCdzIGEgY2xvc2VkCiBsaXN0ICh0aG91
Z2ggYW55b25lIGNhbiBwb3N0KSBhbmQgc2VjdXJpdHkgcmVsYXRlZCBidWcgcmVwb3J0cwogYXJl
IHRyZWF0ZWQgaW4gY29uZmlkZW5jZSB1bnRpbCB0aGUgaW1wYWN0IGhhcyBiZWVuIGVzdGFibGlz
aGVkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fCgpDcmVkaXRzOgoKIFRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292
ZXJlZCBhbmQgZml4ZWQgYnkgRmxvcmlhbiBLb2huaMOkdXNlcgoKX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lv
biBoaXN0b3J5OgoKIDIwMTgtMTAtMjMgMDY6MTU6NDYgVVRDIEluaXRpYWwgUmVwb3J0CiAyMDE4
LTEwLTIzIDIxOjQyOjU4IFVUQyBQYXRjaCBSZWxlYXNlZAogMjAxOC0xMC0yNyAyMToxOTowMCBV
VEMgUGFja2FnZXMgUmVsZWFzZWQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fXwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1
aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQtY2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNo
ZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5ub3VuY2UK