The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy.

Recently, two Denial of Service vulnerabilities have been discovered in squid, a WWW proxy cache. Insufficient input validation in the NTLM authentication handler allowed a remote attacker to crash the service by sending a specially crafted NTLMSSP packet. Likewise, due to an insufficient validation of ASN.1 headers, a remote attacker could restart the server (causing all open connections to be dropped) by sending certain SNMP packets with negative length fields.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A remote attacker is able to cause a denial-of-service situation, when NTLM authentication is enabled in squid. NTLM authentication uses two functions which lack correct offset checking.

An updated squid package that fixes a security vulnerability in the NTLM authentication helper is now available.

Squid is a full-featured Web proxy cache.

An out of bounds memory read bug was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could send a carefully crafted NTLM authentication packet and cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0832 to this issue.

Note: The NTLM authentication helper is not enabled by default in Red Hat Enterprise Linux 3. Red Hat Enterprise Linux 2.1 is not vulnerable to this issue as it shipped with a version of Squid which did not contain the vulnerable helper.

Users of Squid should update to this erratum package, which contains a backported patch and is not vulnerable to this issue.

A vulnerability in the NTLM helpers in squid 2.5 could allow for malformed NTLMSSP packets to crash squid, resulting in a DoS. The provided packages have been patched to prevent this problem.

The remote server is running a Squid proxy server. This version is reported vulnerable to a remote denial of service in the NTLM authentication routine. If NTLM authentication is enabled, an attacker may deny service to legitimate users by sending malformed NTLMSSP packets. 

The remote host is affected by the vulnerability described in GLSA-200409-04 (Squid: Denial of service when using NTLM authentication)

    Squid 2.5.x versions contain a bug in the functions ntlm_fetch_string()     and ntlm_get_string() which lack checking the int32_t offset 'o' for     negative values.
  Impact :

    A remote attacker could cause a denial of service situation by sending     certain malformed NTLMSSP packets if NTLM authentication is enabled.
  Workaround :

    Disable NTLM authentication by removing any 'auth_param ntlm program     ...' directives from squid.conf or use ntlm_auth from Samba-3.x.

The remote server is running a Squid proxy server. This version is reported vulnerable to a remote denial of service in the NTLM authentication routine. If NTLM authentication is enabled, an attacker may deny service to legitimate users by sending malformed NTLMSSP packets.

ID	Name	Product	Family	Severity
20602	Ubuntu 4.10 : squid vulnerabilities (USN-19-1)	Nessus	Ubuntu Local Security Checks	medium
18829	FreeBSD : squid -- NTLM authentication denial-of-service vulnerability (064225c5-1f53-11d9-836a-0090962cff2a)	Nessus	FreeBSD Local Security Checks	medium
15410	RHEL 3 : squid (RHSA-2004:462)	Nessus	Red Hat Local Security Checks	medium
14749	Mandrake Linux Security Advisory : squid (MDKSA-2004:093)	Nessus	Mandriva Local Security Checks	medium
2255	Squid < 2.5.STABLE7 NTLM Authentication DoS	Nessus Network Monitor	Web Servers	high
14651	GLSA-200409-04 : Squid: Denial of service when using NTLM authentication	Nessus	Gentoo Local Security Checks	medium
801032	Squid NTLM Authentication NTLMSSP Packet Remote DoS	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2004-0832

high

Tenable Plugins

medium

medium

medium

medium

high

medium

medium