[ADVISORY] SQUID-2019:5 Heap Overflow issue in HTTP Basic Authentication processing
Amos Jeffries <[email protected]> Sun, 14 Jul 2019 01:33:33 +1200
| Newsgroups | gmane.comp.web.squid.announce |
|---|---|
| Message-ID | <19af35c9-26f7-5710-719f-61a6971aaca4__17524.3787861959$1563025161$gmane$org@treenet.co.nz> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCgogICAgU3F1aWQgUHJveHkgQ2FjaGUgU2VjdXJpdHkgVXBkYXRlIEFkdmlzb3J5 IFNRVUlELTIwMTk6NQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KCkFkdmlzb3J5IElEOiAgICAgICAgU1FVSUQtMjAxOTo1 CkRhdGU6ICAgICAgICAgICAgICAgSnVseSAxMiwgMjAxOQpTdW1tYXJ5OiAgICAgICAgICAgIEhl YXAgT3ZlcmZsb3cgaXNzdWUKICAgICAgICAgICAgICAgICAgICBpbiBIVFRQIEJhc2ljIEF1dGhl bnRpY2F0aW9uIHByb2Nlc3NpbmcuCkFmZmVjdGVkIHZlcnNpb25zOiAgU3F1aWQgNC4wLjIzIC0+ IDQuNwpGaXhlZCBpbiB2ZXJzaW9uOiAgIFNxdWlkIDQuOApfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCiAgICBodHRwOi8v d3d3LnNxdWlkLWNhY2hlLm9yZy9BZHZpc29yaWVzL1NRVUlELTIwMTlfNS50eHQKICAgIGh0dHA6 Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxOS0xMjUyNwpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18KClByb2JsZW0gRGVzY3JpcHRpb246CgogRHVlIHRvIGluY29ycmVjdCBidWZmZXIg bWFuYWdlbWVudCBTcXVpZCBpcyB2dWxuZXJhYmxlIHRvIGEKIGhlYXAgb3ZlcmZsb3cgYW5kIHBv c3NpYmxlIHJlbW90ZSBjb2RlIGV4ZWN1dGlvbiBhdHRhY2sgd2hlbgogcHJvY2Vzc2luZyBIVFRQ IEF1dGhlbnRpY2F0aW9uIGNyZWRlbnRpYWxzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpTZXZlcml0eToKCiBUaGlz IGFsbG93cyBhIG1hbGljaW91cyBjbGllbnQgdG8gd3JpdGUgYSBzdWJzdGFudGlhbCBhbW91bnQg b2YKIGFyYml0cmFyeSBkYXRhIHRvIHRoZSBoZWFwLiBQb3RlbnRpYWxseSBnYWluaW5nIGFiaWxp dHkgdG8KIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUuCgogT24gc3lzdGVtcyB3aXRoIG1lbW9yeSBh Y2Nlc3MgcHJvdGVjdGlvbnMgdGhpcyBjYW4gcmVzdWx0IGluCiB0aGUgU3F1aWQgcHJvY2VzcyBi ZWluZyB0ZXJtaW5hdGVkIHVuZXhwZWN0ZWRseS4gUmVzdWx0aW5nIGluIGEKIGRlbmlhbCBvZiBz ZXJ2aWNlIGZvciBhbGwgY2xpZW50cyB1c2luZyB0aGUgcHJveHkuCgogVGhpcyBpc3N1ZSBpcyBs aW1pdGVkIHRvIHRyYWZmaWMgYWNjZXNzaW5nIHRoZSBTcXVpZCBDYWNoZQogTWFuYWdlciByZXBv cnRzIG9yIHVzaW5nIHRoZSBGVFAgcHJvdG9jb2wgZ2F0ZXdheS4KCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKVXBkYXRl ZCBQYWNrYWdlczoKCiBUaGlzIGJ1ZyBpcyBmaXhlZCBieSBTcXVpZCB2ZXJzaW9uIDQuOC4KCiBJ biBhZGRpdGlvbiwgcGF0Y2hlcyBhZGRyZXNzaW5nIHRoaXMgcHJvYmxlbSBmb3IgdGhlIHN0YWJs ZQogcmVsZWFzZXMgY2FuIGJlIGZvdW5kIGluIG91ciBwYXRjaCBhcmNoaXZlczoKClNxdWlkIDQ6 CiA8aHR0cDovL3d3dy5zcXVpZC1jYWNoZS5vcmcvVmVyc2lvbnMvdjQvY2hhbmdlc2V0cy9zcXVp ZC00LTdmNzNlOWM1ZDE3NjY0Yjg4MmVkMzI1OTBlNmFmMzEwYzI0N2YzMjAucGF0Y2g+CgogSWYg eW91IGFyZSB1c2luZyBhIHByZXBhY2thZ2VkIHZlcnNpb24gb2YgU3F1aWQgdGhlbiBwbGVhc2Ug cmVmZXIKIHRvIHRoZSBwYWNrYWdlIHZlbmRvciBmb3IgYXZhaWxhYmlsaXR5IGluZm9ybWF0aW9u IG9uIHVwZGF0ZWQKIHBhY2thZ2VzLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpEZXRlcm1pbmluZyBpZiB5b3VyIHZl cnNpb24gaXMgdnVsbmVyYWJsZToKCiBBbGwgU3F1aWQtMi54IGFyZSBub3QgdnVsbmVyYWJsZS4K CiBBbGwgU3F1aWQtMy54IGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNC54IHVwIHRv IGFuZCBpbmNsdWRpbmcgNC4wLjIyIGFyZSBub3QgdnVsbmVyYWJsZS4KCiBBbGwgU3F1aWQtNC4w LjIzIHVwIHRvIGFuZCBpbmNsdWRpbmcgNC43IGJ1aWx0IHdpdGggQmFzaWMKIEF1dGhlbnRpY2F0 aW9uIGZlYXR1cmVzIGFyZSB2dWxuZXJhYmxlLgoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpXb3JrYXJvdW5kczoKCkVp dGhlcjsKCiBEZW55IGZ0cDovLyBwcm90b2NvbCBVUkxzIGJlaW5nIHByb3hpZWQgYW5kIENhY2hl IE1hbmFnZXIgcmVwb3J0CiBhY2Nlc3MgdG8gYWxsIGNsaWVudHM6CgogICAgYWNsIEZUUCBwcm90 byBGVFAKICAgIGh0dHBfYWNjZXNzIGRlbnkgRlRQCiAgICBodHRwX2FjY2VzcyBkZW55IG1hbmFn ZXIKCk9yLAoKIEJ1aWxkIFNxdWlkIHdpdGggLS1kaXNhYmxlLWF1dGgtYmFzaWMKCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwoKQ29udGFjdCBkZXRhaWxzIGZvciB0aGUgU3F1aWQgcHJvamVjdDoKCiBGb3IgaW5zdGFsbGF0 aW9uIC8gdXBncmFkZSBzdXBwb3J0IG9uIGJpbmFyeSBwYWNrYWdlZCB2ZXJzaW9ucwogb2YgU3F1 aWQ6IFlvdXIgZmlyc3QgcG9pbnQgb2YgY29udGFjdCBzaG91bGQgYmUgeW91ciBiaW5hcnkKIHBh Y2thZ2UgdmVuZG9yLgoKIElmIHlvdXIgaW5zdGFsbCBhbmQgYnVpbGQgU3F1aWQgZnJvbSB0aGUg b3JpZ2luYWwgU3F1aWQgc291cmNlcwogdGhlbiB0aGUgc3F1aWQtdXNlcnNAbGlzdHMuc3F1aWQt Y2FjaGUub3JnIG1haWxpbmcgbGlzdCBpcyB5b3VyCiBwcmltYXJ5IHN1cHBvcnQgcG9pbnQuIEZv ciBzdWJzY3JpcHRpb24gZGV0YWlscyBzZWUKIDxodHRwOi8vd3d3LnNxdWlkLWNhY2hlLm9yZy9T dXBwb3J0L21haWxpbmctbGlzdHMuaHRtbD4uCgogRm9yIHJlcG9ydGluZyBvZiBub24tc2VjdXJp dHkgYnVncyBpbiB0aGUgbGF0ZXN0IFNUQUJMRSByZWxlYXNlCiB0aGUgc3F1aWQgYnVnemlsbGEg ZGF0YWJhc2Ugc2hvdWxkIGJlIHVzZWQKIDxodHRwOi8vYnVncy5zcXVpZC1jYWNoZS5vcmcvPi4K CiBGb3IgcmVwb3J0aW5nIG9mIHNlY3VyaXR5IHNlbnNpdGl2ZSBidWdzIHNlbmQgYW4gZW1haWwg dG8gdGhlCiBzcXVpZC1idWdzQGxpc3RzLnNxdWlkLWNhY2hlLm9yZyBtYWlsaW5nIGxpc3QuIEl0 J3MgYSBjbG9zZWQKIGxpc3QgKHRob3VnaCBhbnlvbmUgY2FuIHBvc3QpIGFuZCBzZWN1cml0eSBy ZWxhdGVkIGJ1ZyByZXBvcnRzCiBhcmUgdHJlYXRlZCBpbiBjb25maWRlbmNlIHVudGlsIHRoZSBp bXBhY3QgaGFzIGJlZW4gZXN0YWJsaXNoZWQuCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KCkNyZWRpdHM6CgogVGhpcyB2 dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IEplcmlrbyBPbmUKIDxqZXJpa28ub25lQGdt eC51cz4uCgogRml4ZWQgYnkgQW1vcyBKZWZmcmllcyBvZiBUcmVlaG91c2UgTmV0d29ya3MgTHRk LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fCgpSZXZpc2lvbiBoaXN0b3J5OgoKIDIwMTktMDUtMTQgMTQ6NTY6NDkgVVRD IEluaXRpYWwgUmVwb3J0CiAyMDE5LTA2LTA1IDE1OjUyOjE3IFVUQyBDVkUgQXNzaWdubWVudAog MjAxOS0wNi0xOSAwNTo1ODozNiBVVEMgUGF0Y2hlcyBSZWxlYXNlZApfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRU5ECl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNxdWlkLWFubm91 bmNlIG1haWxpbmcgbGlzdApzcXVpZC1hbm5vdW5jZUBsaXN0cy5zcXVpZC1jYWNoZS5vcmcKaHR0 cDovL2xpc3RzLnNxdWlkLWNhY2hlLm9yZy9saXN0aW5mby9zcXVpZC1hbm5vdW5jZQo=