The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (segmentation fault) via certain crafted requests.

An updated Squid package that fixes security issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid displays error messages. A remote attacker could submit a request containing an invalid hostname which would result in Squid displaying a previously used error message. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-2479 to this issue.

Two denial of service bugs were found in the way Squid handles malformed requests. A remote attacker could submit a specially crafted request to Squid that would cause the server to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2794 and CVE-2005-2796 to these issues.

Please note that CVE-2005-2796 does not affect Red Hat Enterprise Linux 2.1

Users of Squid should upgrade to this updated package that contains backported patches, and is not vulnerable to these issues.

The squid patches page notes :

After certain slightly odd requests Squid crashes with a segmentation fault in sslConnectTimeout.

A Denial of Service vulnerability was discovered in the handling of aborted requests. A remote attacker could exploit this to crash Squid by sending specially crafted requests. (CAN-2005-2794)

Alex Masterov discovered a Denial of Service vulnerability in the sslConnectTimeout() function. By sending specially crafted SSL requests, a remote attacker could exploit this to crash Squid.
(CAN-2005-2796).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were recently discovered in squid :

The first is a DoS possible via certain aborted requests that trigger an assertion error related to 'STOP_PENDING' (CVE-2005-2794).

The second is a DoS caused by certain crafted requests and SSL timeouts (CVE-2005-2796).

The updated packages have been patched to address these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:766 advisory.

    Squid is a full-featured Web proxy cache.

    A bug was found in the way Squid displays error messages. A remote attacker     could submit a request containing an invalid hostname which would result in     Squid displaying a previously used error message. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-2479 to this issue.

    Two denial of service bugs were found in the way Squid handles malformed     requests. A remote attacker could submit a specially crafted request to     Squid that would cause the server to crash. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the names CAN-2005-2794 and     CAN-2005-2796 to these issues.

    Please note that CAN-2005-2796 does not affect Red Hat Enterprise Linux 2.1

    Users of Squid should upgrade to this updated package that contains     backported patches, and is not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Certain aborted requests that trigger an assertion in squid, the popular WWW proxy cache, may allow remote attackers to cause a denial of service.  This update also fixes a regression caused by DSA 751.
For completeness below is the original advisory text :

  Several vulnerabilities have been discovered in Squid, the popular   WWW proxy cache. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CAN-2005-2794       Certain aborted requests that trigger an assert may       allow remote attackers to cause a denial of service.

    - CAN-2005-2796

      Specially crafted requests can cause a denial of       service.

The remote host is affected by the vulnerability described in GLSA-200509-06 (Squid: Denial of Service vulnerabilities)

    Certain malformed requests result in a segmentation fault in the     sslConnectTimeout function, handling of other certain requests trigger     assertion failures.
  Impact :

    By performing malformed requests an attacker could cause Squid to crash     by triggering an assertion failure or invalid memory reference.
  Workaround :

    There is no known workaround at this time.

The remote Squid caching proxy, according to its version number, is vulnerable to an attack where the attacker can cause the Squid proxy to stop servicing valid service requests.  The flaw is within the 'sslConnectTimeout' function and stems from the functions inability to parse user-supplied requests.  Successful exploitation leads to a loss of availability.  

ID	Name	Product	Family	Severity
21855	CentOS 3 / 4 : squid (CESA-2005:766)	Nessus	CentOS Local Security Checks	medium
21427	FreeBSD : squid -- Denial Of Service Vulnerability in sslConnectTimeout (4e210d72-1c5c-11da-92ce-0048543d60ce)	Nessus	FreeBSD Local Security Checks	medium
20594	Ubuntu 4.10 / 5.04 : squid vulnerabilities (USN-183-1)	Nessus	Ubuntu Local Security Checks	medium
19917	Mandrake Linux Security Advisory : squid (MDKSA-2005:162)	Nessus	Mandriva Local Security Checks	medium
19713	RHEL 4 : squid (RHSA-2005:766)	Nessus	Red Hat Local Security Checks	high
19684	Debian DSA-809-2 : squid - several vulnerabilities	Nessus	Debian Local Security Checks	medium
19671	GLSA-200509-06 : Squid: Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
3206	Squid < 2.5.STABLE11 sslConnectTimeout DoS	Nessus Network Monitor	Web Servers	high
801036	Squid sslConnectTimeout Function Remote DoS	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2005-2796

high

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

high

high