Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).

Remote exploitation of a buffer overflow vulnerability in the NTLM authentication helper routine of the Squid Web Proxy Cache could allow a remote attacker to execute arbitrary code. A remote attacker can compromise a target system if the Squid Proxy is configured to use the NTLM authentication helper. The attacker can send an overly long password to overflow the buffer and execute arbitrary code.

The remote server is running a Squid proxy server. This version is reported vulnerable to a remote buffer overflow in the NTLM authentication routine. If the client sends an overly long password or domain name, a buffer is overflowed on the server. This may result in the execution of arbitrary code on the Squid proxy server.

The remote host is affected by the vulnerability described in GLSA-200406-13 (Squid: NTLM authentication helper buffer overflow)

    Squid is a full-featured Web Proxy Cache designed to run on Unix systems.
    It supports proxying and caching of HTTP, FTP, and other URLs, as well as     SSL support, cache hierarchies, transparent caching, access control lists     and many other features.
  Impact :

    If Squid is configured to use NTLM authentication, an attacker could     exploit this vulnerability by sending a very long password. This could lead     to arbitrary code execution with the permissions of the user running Squid.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

A vulnerability exists in squid's NTLM authentication helper. This buffer overflow can be exploited by a remote attacker by sending an overly long password, thus overflowing the buffer and granting the ability to execute arbitrary code. This can only be exploited, however, if NTLM authentication is used. NTLM authentication is built by default in Mandrakelinux packages, but is not enabled in the default configuration.

The vulnerability exists in 2.5.*-STABLE and 3.*-PRE. The provided packages are patched to fix this problem.

The remote host is missing the patch for the advisory SuSE-SA:2004:016 (squid).


Squid is a feature-rich web-proxy with support for various web-related protocols.
The NTLM authentication helper application of Squid is vulnerable to a buffer overflow that can be exploited remotely by using a long password to execute arbitrary code.
NTLM authentication is enabled by default in the Squid package that is shipped by SUSE LINUX.

There is no workaround known other then turning off the NTLM authentication.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

An updated squid package that fixes a security vulnerability in the NTLM authentication helper is now available.

Squid is a full-featured Web proxy cache.

A buffer overflow was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could potentially execute arbitrary code by sending a lengthy password. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0541 to this issue.

Note: The NTLM authentication helper is not enabled by default in Red Hat Enterprise Linux 3. Red Hat Enterprise Linux 2.1 is not vulnerable to this issue as it shipped with a version of Squid which did not contain the helper.

Users of Squid should update to this errata package which contains a backported patch that is not vulnerable to this issue.

The remote server is affected by a remote code execution vulnerability in the Squid Internet Object Cache server due to a failure to test the length of the user-supplied LanMan hash value in the ntlm_check_auth() function in libntlmssp.c. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a stack-based buffer overflow, resulting in the execution of arbitrary code.

Note that Squid 2.5*-STABLE and 3.*-PRE are reportedly vulnerable.

The remote server is running a Squid proxy server. This version is reported vulnerable to a remote buffer overflow in the NTLM authentication routine.  Exploitation of this vulnerability can allow remote attackers to gain access to confidential data.

ID	Name	Product	Family	Severity
36518	FreeBSD : Buffer overflow in Squid NTLM authentication helper (6f955451-ba54-11d8-b88c-000d610a3b12)	Nessus	FreeBSD Local Security Checks	critical
2185	Squid < 2.5.STABLE6 NTLM Buffer Overflow	Nessus Network Monitor	Web Servers	critical
14524	GLSA-200406-13 : Squid: NTLM authentication helper buffer overflow	Nessus	Gentoo Local Security Checks	critical
14158	Mandrake Linux Security Advisory : squid (MDKSA-2004:059)	Nessus	Mandriva Local Security Checks	critical
13832	SuSE-SA:2004:016: squid	Nessus	SuSE Local Security Checks	critical
12504	RHEL 3 : squid (RHSA-2004:242)	Nessus	Red Hat Local Security Checks	critical
12294	Squid ntlm_check_auth Function NTLM Authentication Helper Password Handling Remote Overflow	Nessus	Firewalls	critical
801046	Squid Remote NTLM Authentication Password Handling Remote Overflow	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2004-0541

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high