[ADVISORY] SQUID-2019:1 Denial of Service issue in cachemgr.cgi
Amos Jeffries <[email protected]> Sun, 14 Jul 2019 01:31:10 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <bac263e7-2b31-da04-0a47-d3d7a787f7c3__8269.24224836461$1563024890$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6MQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOTox CkRhdGU6ICAgICAgICAgICAgICAgSnVseSAxMiwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAgIERl bmlhbCBvZiBTZXJ2aWNlIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgaW4gY2FjaGVtZ3IuY2dp CkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgNC54IC0+IDQuNwpGaXhlZCBpbiB2ZXJzaW9uOiAg IFNxdWlkIDQuOApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZp c29yaWVzL1NRVUlELTIwMTlfMS50eHQKICAgIGh0dHA6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4v Y3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxOS0xMjg1NApfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClByb2JsZW0gRGVzY3Jp cHRpb246CgogRHVlIHRvIGluY29ycmVjdCBzdHJpbmcgdGVybWluYXRpb24gdGhlIGNhY2hlbWdy LmNnaSBtYXkgYWNjZXNzCiB1bmFsbG9jYXRlZCBtZW1vcnkuCgogT24gc3lzdGVtcyB3aXRoIG1l bW9yeSBhY2Nlc3MgcHJvdGVjdGlvbnMgdGhpcyBjYW4gcmVzdWx0IGluCiB0aGUgQ0dJIHByb2Nl c3MgdGVybWluYXRpbmcgdW5leHBlY3RlZGx5LiBSZXN1bHRpbmcgaW4gYQogZGVuaWFsIG9mIHNl cnZpY2UgZm9yIGFsbCBjbGllbnRzIHVzaW5nIGl0LgoKX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiBU aGlzIHByb2JsZW0gYWxsb3dzIGEgcmVtb3RlIGF0dGFja2VyIHdpdGggYWNjZXNzIHRvIHRoZSBT cXVpZAogbWFuYWdlciBBUEkgdG8gcGVyZm9ybSBhIGRlbmlhbCBvZiBzZXJ2aWNlIG9uIG90aGVy IGNsaWVudHMuCgogVGhpcyBwcm9ibGVtIGlzIGxpbWl0ZWQgdG8gdGhlIGNhY2hlbWdyIENHSSBi aW5hcnkuCgogV2ViIHNlcnZlcnMgd2hpY2ggcnVuIHBlci1jbGllbnQgaW5zdGFuY2VzIG9mIENH SSB0b29scyBhcmUKIGFmZmVjdGVkIGJ5IHRoZSBpc3N1ZSwgYnV0IHRoZSBkZW5pYWwgb2Ygc2Vy dmljZSBpcyBub3QgYWJsZSB0bwogYWZmZWN0IG90aGVyIGNsaWVudHMuCgpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KClVw ZGF0ZWQgUGFja2FnZXM6CgogVGhpcyBidWcgaXMgZml4ZWQgYnkgU3F1aWQgdmVyc2lvbiA0Ljgu CgogSW4gYWRkaXRpb24sIHBhdGNoZXMgYWRkcmVzc2luZyB0aGlzIHByb2JsZW0gZm9yIHRoZSBz dGFibGUKIHJlbGVhc2VzIGNhbiBiZSBmb3VuZCBpbiBvdXIgcGF0Y2ggYXJjaGl2ZXM6CgpTcXVp ZCA0OgogaHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9z cXVpZC00LTI5ODFhOTU3NzE2YzYxZmY3ZTIxZWVlMWQ3ZDZlYjVhMjM3ZTQ2NmQucGF0Y2gKCiBJ ZiB5b3UgYXJlIHVzaW5nIGEgcHJlcGFja2FnZWQgdmVyc2lvbiBvZiBTcXVpZCB0aGVuIHBsZWFz ZSByZWZlcgogdG8gdGhlIHBhY2thZ2UgdmVuZG9yIGZvciBhdmFpbGFiaWxpdHkgaW5mb3JtYXRp b24gb24gdXBkYXRlZAogcGFja2FnZXMuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkRldGVybWluaW5nIGlmIHlvdXIg dmVyc2lvbiBpcyB2dWxuZXJhYmxlOgoKIEFsbCBjYWNoZW1nci5jZ2kgMy54IGFuZCBvbGRlciB2 ZXJzaW9ucyBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIGNhY2hlbWdyLmNnaSA0LnggdmVyc2lv bnMgdXAgdG8gYW5kIGluY2x1ZGluZyA0LjcgYXJlCiB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC00 LjcgYW5kIG9sZGVyIHZlcnNpb25zIGFjY2Vzc2VkIHZpYSB0aGUgaHR0cDovLyBVUkwKIG1hbmFn ZXIgaW50ZXJmYWNlIGFyZSBub3QgdnVsbmVyYWJsZS4KClRvIGRldGVybWluZSB0aGUgdmVyc2lv biBhbmQgaW50ZXJmYWNlLCBsb29rIGF0IHRoZSBmb290ZXIgb2YKbWFuYWdlciByZXBvcnRzIGZv ciB0aGUgIkdlbmVyYXRlZCBieSIgc3RyaW5nLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kczoKCkVp dGhlcjsKCiBDb252ZXJ0IHRvIGV4Y2x1c2l2ZWx5IHVzaW5nIHRoZSBIVFRQIG1hbmFnZXIgaW50 ZXJmYWNlIHVudGlsCiBjYWNoZW1nci5jZ2kgY2FuIGJlIHVwZ3JhZGVkIHRvIGEgZml4ZWQgYnVp bGQuCgpPcjsKCiBEZW55IGFsbCBhY2Nlc3Mgd2l0aCAnbWFuYWdlcicgQUNMIGluIHNxdWlkLmNv bmYuCgogVGhpcyBjb21wbGV0ZWx5IHJlbW92ZXMgdGhlIHZ1bG5lcmFiaWxpdHkgYXQgY29zdCBv ZiByZWR1Y2VkCiBtYW5hZ2VtZW50IGFuZCBtb25pdG9yaW5nIGNhcGFiaWxpdGllcy4KCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFs bGF0aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2Yg U3F1aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkK IHBhY2thZ2UgdmVuZG9yLgoKIElmIHlvdXIgaW5zdGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0 aGUgb3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1aWQtdXNlcnNAbGlzdHMuc3F1 aWQtY2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQu IEZvciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9y Zy9TdXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2Vj dXJpdHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJMRSByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemls bGEgZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQKIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcv Pi4KCiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1h aWwgdG8gdGhlCiBzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3Qu IEl0J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0 eSByZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRo ZSBpbXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogVGhp cyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IEFsZXggUm91c3Nrb3Ygb2YgVGhlCiBN ZWFzdXJlbWVudCBGYWN0b3J5LgoKIEZpeGVkIGJ5IEFtb3MgSmVmZnJpZXMgZnJvbSBUcmVlaG91 c2UgTmV0d29ya3MgTHRkLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIwMTktMDQt MTAgMjE6MTM6NTAgVVRDIEluaXRpYWwgUmVwb3J0CiAyMDE5LTA1LTE4IDA5OjQzOjQxIFVUQyBQ YXRjaCBSZWxlYXNlZAogMjAxOS0wNi0xNiAxMDo1Mjo1MSBVVEMgQ1ZFIEFzc2lnbm1lbnQKX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCkVORApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpzcXVpZC1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKc3F1aWQtYW5ub3VuY2VAbGlzdHMuc3F1aWQt Y2FjaGUub3JnCmh0dHA6Ly9saXN0cy5zcXVpZC1jYWNoZS5vcmcvbGlzdGluZm8vc3F1aWQtYW5u b3VuY2UK