[ADVISORY] SQUID-2019:3 Denial of Service in HTTP Digest Authentication processing
Amos Jeffries <[email protected]> Sun, 14 Jul 2019 01:33:00 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <241fa895-1623-0885-a1ea-e15c85706f99__48959.3772961356$1563025076$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6MwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOToz CkRhdGU6ICAgICAgICAgICAgICAgSnVseSAxMiwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAgIERl bmlhbCBvZiBTZXJ2aWNlIGlzc3VlCiAgICAgICAgICAgICAgICAgICAgaW4gSFRUUCBEaWdlc3Qg QXV0aGVudGljYXRpb24gcHJvY2Vzc2luZy4KQWZmZWN0ZWQgdmVyc2lvbnM6ICBTcXVpZCAzLjMu OSAtPiAzLjUuMjgKICAgICAgICAgICAgICAgICAgICBTcXVpZCA0LnggLT4gNC43CkZpeGVkIGlu IHZlcnNpb246ICAgU3F1aWQgNC44Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKICAgIGh0dHA6Ly93d3cuc3F1aWQtY2Fj aGUub3JnL0Fkdmlzb3JpZXMvU1FVSUQtMjAxOV8zLnR4dAogICAgaHR0cDovL2N2ZS5taXRyZS5v cmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDE5LTEyNTI1Cl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUHJv YmxlbSBEZXNjcmlwdGlvbjoKCiBEdWUgdG8gaW5jb3JyZWN0IGJ1ZmZlciBtYW5hZ2VtZW50IFNx dWlkIGlzIHZ1bG5lcmFibGUgdG8gYQogZGVuaWFsIG9mIHNlcnZpY2UgYXR0YWNrIHdoZW4gcHJv Y2Vzc2luZyBIVFRQIERpZ2VzdAogQXV0aGVudGljYXRpb24gY3JlZGVudGlhbHMuCgpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18KClNldmVyaXR5OgoKIER1ZSB0byBpbmNvcnJlY3QgaW5wdXQgdmFsaWRhdGlvbiB0aGUgSFRU UCBSZXF1ZXN0IGhlYWRlcgogcGFyc2VyIGZvciBEaWdlc3QgYXV0aGVudGljYXRpb24gbWF5IGFj Y2VzcyBtZW1vcnkgb3V0c2lkZSB0aGUKIGFsbG9jYXRlZCBtZW1vcnkgYnVmZmVyLgoKIE9uIHN5 c3RlbXMgd2l0aCBtZW1vcnkgYWNjZXNzIHByb3RlY3Rpb25zIHRoaXMgY2FuIHJlc3VsdCBpbgog dGhlIFNxdWlkIHByb2Nlc3MgYmVpbmcgdGVybWluYXRlZCB1bmV4cGVjdGVkbHkuIFJlc3VsdGlu ZyBpbiBhCiBkZW5pYWwgb2Ygc2VydmljZSBmb3IgYWxsIGNsaWVudHMgdXNpbmcgdGhlIHByb3h5 LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCgpVcGRhdGVkIFBhY2thZ2VzOgoKIFRoaXMgYnVnIGlzIGZpeGVkIGJ5IFNx dWlkIHZlcnNpb24gNC44LgoKIEluIGFkZGl0aW9uLCBwYXRjaGVzIGFkZHJlc3NpbmcgdGhpcyBw cm9ibGVtIGZvciB0aGUgc3RhYmxlCiByZWxlYXNlcyBjYW4gYmUgZm91bmQgaW4gb3VyIHBhdGNo IGFyY2hpdmVzOgoKU3F1aWQgMy41OgogPGh0dHA6Ly93d3cuc3F1aWQtY2FjaGUub3JnL1ZlcnNp b25zL3YzLzMuNS9jaGFuZ2VzZXRzL3NxdWlkLTMuNS1lYzBkMGYzOWNmMjhkYTE0ZWVhZDBiYTVl Nzc3ZTk1ODU1YmMyZjY3LnBhdGNoPgoKU3F1aWQgNDoKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hl Lm9yZy9WZXJzaW9ucy92NC9jaGFuZ2VzZXRzL3NxdWlkLTQtNDA5OTU2NTM2NjQ3YjNhMDVlZTFl MzY3NDI0YTI0YWU2YjhmMTNmZC5wYXRjaD4KCiBJZiB5b3UgYXJlIHVzaW5nIGEgcHJlcGFja2Fn ZWQgdmVyc2lvbiBvZiBTcXVpZCB0aGVuIHBsZWFzZSByZWZlcgogdG8gdGhlIHBhY2thZ2UgdmVu ZG9yIGZvciBhdmFpbGFiaWxpdHkgaW5mb3JtYXRpb24gb24gdXBkYXRlZAogcGFja2FnZXMuCgpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18KCkRldGVybWluaW5nIGlmIHlvdXIgdmVyc2lvbiBpcyB2dWxuZXJhYmxlOgoKIEFs bCBTcXVpZC0yLnggYXJlIG5vdCB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLnggdXAgdG8gYW5k IGluY2x1ZGluZyAzLjMuOCBhcmUgbm90IHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMuMy45IHVw IHRvIGFuZCBpbmNsdWRpbmcgMy4zLjE0IGJlaW5nIHVzZWQgZm9yIERpZ2VzdAogYXV0aGVudGlj YXRpb24gYXJlIHZ1bG5lcmFibGUuCgogQWxsIFNxdWlkLTMuNCB2ZXJzaW9ucyB1cCB0byBhbmQg aW5jbHVkaW5nIDMuNC4xNCBiZWluZyB1c2VkIGZvcgogRGlnZXN0IGF1dGhlbnRpY2F0aW9uIGFy ZSB2dWxuZXJhYmxlLgoKIEFsbCBTcXVpZC0zLjUgdmVyc2lvbnMgdXAgdG8gYW5kIGluY2x1ZGlu ZyAzLjUuMjggYmVpbmcgdXNlZCBmb3IKIERpZ2VzdCBhdXRoZW50aWNhdGlvbiBhcmUgdnVsbmVy YWJsZS4KCiBBbGwgU3F1aWQtNC54IHVwIHRvIGFuZCBpbmNsdWRpbmcgNC43IGJlaW5nIHVzZWQg Zm9yIERpZ2VzdAogQXV0aGVudGljYXRpb24gYXJlIHZ1bG5lcmFibGUuCgoKVG8gZGV0ZXJtaW5l IHdoZXRoZXIgYXV0aF9wYXJhbSBpcyBjb25maWd1cmVkIGZvciBEaWdlc3QKYXV0aGVudGljYXRp b24gdXNlIHRoZSBjb21tYW5kOgoKIHNxdWlkIC1rIHBhcnNlIHwgZ3JlcCBhdXRoX3BhcmFtCgpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18KCldvcmthcm91bmRzOgoKRWl0aGVyOwoKIFJlbW92ZSAnYXV0aF9wYXJhbSBkaWdl c3QgLi4uJyBjb25maWd1cmF0aW9uIHNldHRpbmdzIGZyb20KIHNxdWlkLmNvbmYuCgpPciwKCiBC dWlsZCBTcXVpZCB3aXRoIC0tZGlzYWJsZS1hdXRoLWRpZ2VzdAoKCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKQ29udGFj dCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0aW9uIC8gdXBn cmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1aWQ6IFlvdXIg Zmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBhY2thZ2UgdmVu ZG9yLgoKIElmIHlvdXIgaW5zdGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUgb3JpZ2luYWwg U3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQtY2FjaGUub3Jn IG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQuIEZvciBzdWJzY3Jp cHRpb24gZGV0YWlscyBzZWUKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9TdXBwb3J0L21h aWxpbmctbGlzdHMuaHRtbD4uCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJpdHkgYnVncyBp biB0aGUgbGF0ZXN0IFNUQUJMRSByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemlsbGEgZGF0YWJhc2Ug c2hvdWxkIGJlIHVzZWQKIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4KCiBGb3IgcmVw b3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1haWwgdG8gdGhlCiBz cXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QuIEl0J3MgYSBjbG9z ZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSByZWxhdGVkIGJ1 ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBpbXBhY3QgaGFz IGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogVGhpcyB2dWxuZXJhYmls aXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IEplcmlrbyBPbmUKIDxqZXJpa28ub25lQGdteC51cz4uCgog Rml4ZWQgYnkgQW1vcyBKZWZmcmllcyBvZiBUcmVlaG91c2UgTmV0d29ya3MgTHRkLgoKX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIwMTktMDUtMTQgMTQ6NTY6NDkgVVRDIEluaXRpYWwg UmVwb3J0CiAyMDE5LTA2LTA1IDE1OjUyOjE3IFVUQyBDVkUgQXNzaWdubWVudAogMjAxOS0wNi0w OCAyMTowOToyMyBVVEMgUGF0Y2hlcyBSZWxlYXNlZApfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91bmNlIG1haWxp bmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0cDovL2xpc3Rz LnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=