Advertisement






Squid Analysis Report Generator <= 2.2.3.1 buffer overflow

CVE Category Price Severity
CVE-2010-2850 CWE-119 $5,000 High
Author Risk Exploitation Type Date
Kingcope High Local 2010-01-07
CPE
cpe:cpe:/a:squid_analysis_report_generator:squid_analysis_report_generator:2.2.3.1
CVSS EPSS EPSSP
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2010010131

Below is a copy:

======================================================================
Squid Analysis Report Generator <= 2.2.3.1 buffer overflow
======================================================================

Author:          L4teral <l4teral [4t] gmail com>
Impact:          buffer overflow
Status:          fixed version available

------------------------------
Affected software description:
------------------------------

Application:     Squid Analysis Report Generator
Version:         <= 2.2.3.1
Vendor:          http://sarg.sourceforge.net

Description:
Squid Analysis Report Generator is a tool that allow you to view
"where" your users are going to on the Internet.

--------------
Vulnerability:
--------------

Execution of arbitrary code is possible by executing sarg with
specially crafted squid log files (access and useragent log).

The access.log has to be manually created to trigger the exploit,
as squid will not allow malformed HTTP methods.

The useragent log is more critical, as this vulnerability can be
exploited by just passing the useragent string within a request
to the squid proxy.

------------
PoC/Exploit:
------------

Edit a normal access log and set the request method to an overly long
string.

Edit a normal useragent log and set the useragent field to an overly
long string or send a request to the Squid proxy server passing an
overly long string as useragent in the HTTP header.

---------
Solution:
---------

Upgrade to version 2.2.4 or higher.

---------
Timeline:
---------

2008-01-28 - vendor informed
2008-01-28 - vendor responded
2008-03-02 - vendor released new version
2008-03-03 - public disclosure



Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.