[ADVISORY] SQUID-2019:5 Heap Overflow issue in HTTP Basic Authentication processing

Amos Jeffries <[email protected]> Sun, 14 Jul 2019 01:33:33 +1200
Newsgroups gmane.comp.web.squid.announce
Message-ID <19af35c9-26f7-5710-719f-61a6971aaca4__17524.3787861959$1563025161$gmane$org@treenet.co.nz>
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5
IFNRVUlELTIwMTk6NQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOTo1
CkRhdGU6ICAgICAgICAgICAgICAgSnVseSAxMiwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAgIEhl
YXAgT3ZlcmZsb3cgaXNzdWUKICAgICAgICAgICAgICAgICAgICBpbiBIVFRQIEJhc2ljIEF1dGhl
bnRpY2F0aW9uIHByb2Nlc3NpbmcuCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgNC4wLjIzIC0+
IDQuNwpGaXhlZCBpbiB2ZXJzaW9uOiAgIFNxdWlkIDQuOApfX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8v
d3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZpc29yaWVzL1NRVUlELTIwMTlfNS50eHQKICAgIGh0dHA6
Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxOS0xMjUyNwpf
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX18KClByb2JsZW0gRGVzY3JpcHRpb246CgogRHVlIHRvIGluY29ycmVjdCBidWZmZXIg
bWFuYWdlbWVudCBTcXVpZCBpcyB2dWxuZXJhYmxlIHRvIGEKIGhlYXAgb3ZlcmZsb3cgYW5kIHBv
c3NpYmxlIHJlbW90ZSBjb2RlIGV4ZWN1dGlvbiBhdHRhY2sgd2hlbgogcHJvY2Vzc2luZyBIVFRQ
IEF1dGhlbnRpY2F0aW9uIGNyZWRlbnRpYWxzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiBUaGlz
IGFsbG93cyBhIG1hbGljaW91cyBjbGllbnQgdG8gd3JpdGUgYSBzdWJzdGFudGlhbCBhbW91bnQg
b2YKIGFyYml0cmFyeSBkYXRhIHRvIHRoZSBoZWFwLiBQb3RlbnRpYWxseSBnYWluaW5nIGFiaWxp
dHkgdG8KIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUuCgogT24gc3lzdGVtcyB3aXRoIG1lbW9yeSBh
Y2Nlc3MgcHJvdGVjdGlvbnMgdGhpcyBjYW4gcmVzdWx0IGluCiB0aGUgU3F1aWQgcHJvY2VzcyBi
ZWluZyB0ZXJtaW5hdGVkIHVuZXhwZWN0ZWRseS4gUmVzdWx0aW5nIGluIGEKIGRlbmlhbCBvZiBz
ZXJ2aWNlIGZvciBhbGwgY2xpZW50cyB1c2luZyB0aGUgcHJveHkuCgogVGhpcyBpc3N1ZSBpcyBs
aW1pdGVkIHRvIHRyYWZmaWMgYWNjZXNzaW5nIHRoZSBTcXVpZCBDYWNoZQogTWFuYWdlciByZXBv
cnRzIG9yIHVzaW5nIHRoZSBGVFAgcHJvdG9jb2wgZ2F0ZXdheS4KCl9fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRl
ZCBQYWNrYWdlczoKCiBUaGlzIGJ1ZyBpcyBmaXhlZCBieSBTcXVpZCB2ZXJzaW9uIDQuOC4KCiBJ
biBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMgcHJvYmxlbSBmb3IgdGhlIHN0YWJs
ZQogcmVsZWFzZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDQ6
CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9zcXVp
ZC00LTdmNzNlOWM1ZDE3NjY0Yjg4MmVkMzI1OTBlNmFmMzEwYzI0N2YzMjAucGF0Y2g+CgogSWYg
eW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2Ug
cmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9u
IG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZl
cnNpb24gaXMgdnVsbmVyYWJsZToKCiBBbGwgU3F1aWQtMi54IGFyZSBub3QgdnVsbmVyYWJsZS4K
CiBBbGwgU3F1aWQtMy54IGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNC54IHVwIHRv
IGFuZCBpbmNsdWRpbmcgNC4wLjIyIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNC4w
LjIzIHVwIHRvIGFuZCBpbmNsdWRpbmcgNC43IGJ1aWx0IHdpdGggQmFzaWMKIEF1dGhlbnRpY2F0
aW9uIGZlYXR1cmVzIGFyZSB2dWxuZXJhYmxlLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kczoKCkVp
dGhlcjsKCiBEZW55IGZ0cDovLyBwcm90b2NvbCBVUkxzIGJlaW5nIHByb3hpZWQgYW5kIENhY2hl
IE1hbmFnZXIgcmVwb3J0CiBhY2Nlc3MgdG8gYWxsIGNsaWVudHM6CgogICAgYWNsIEZUUCBwcm90
byBGVFAKICAgIGh0dHBfYWNjZXNzIGRlbnkgRlRQCiAgICBodHRwX2FjY2VzcyBkZW55IG1hbmFn
ZXIKCk9yLAoKIEJ1aWxkIFNxdWlkIHdpdGggLS1kaXNhYmxlLWF1dGgtYmFzaWMKCl9fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
XwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0
aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1
aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBh
Y2thZ2UgdmVuZG9yLgoKIElmIHlvdXIgaW5zdGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUg
b3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQt
Y2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQuIEZv
ciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9T
dXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJp
dHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJMRSByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemlsbGEg
ZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQKIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4K
CiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1haWwg
dG8gdGhlCiBzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QuIEl0
J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSBy
ZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBp
bXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogVGhpcyB2
dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IEplcmlrbyBPbmUKIDxqZXJpa28ub25lQGdt
eC51cz4uCgogRml4ZWQgYnkgQW1vcyBKZWZmcmllcyBvZiBUcmVlaG91c2UgTmV0d29ya3MgTHRk
LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIwMTktMDUtMTQgMTQ6NTY6NDkgVVRD
IEluaXRpYWwgUmVwb3J0CiAyMDE5LTA2LTA1IDE1OjUyOjE3IFVUQyBDVkUgQXNzaWdubWVudAog
MjAxOS0wNi0xOSAwNTo1ODozNiBVVEMgUGF0Y2hlcyBSZWxlYXNlZApfX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91
bmNlIG1haWxpbmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0
cDovL2xpc3RzLnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=