FreeBSD : squidGuard -- multiple vulnerabilities (692ab645-bf5d-11de-849b-00151797c2d4)

medium Nessus Plugin ID 42213

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

SquidGuard website reports :

Patch 20091015 fixes one buffer overflow problem in sgLog.c when overlong URLs are requested. SquidGuard will then go into emergency mode were no blocking occurs. This is not required in this situation.

Patch 20091019 fixes two bypass problems with URLs which length is close to the limit defined by MAX_BUF (default: 4096) in squidGuard and MAX_URL (default : 4096 in squid 2.x and 8192 in squid 3.x) in squid. For this kind of URLs the proxy request exceeds MAX_BUF causing squidGuard to complain about not being able to parse the squid request. Increasing the buffer limit to be higher than the one defined in MAX_URL solves the issue.

Solution

Update the affected package.

Plugin Details

Severity: Medium

ID: 42213

File Name: freebsd_pkg_692ab645bf5d11de849b00151797c2d4.nasl

Version: 1.13

Type: local

Family: FreeBSD Local Security Checks

Published: 10/23/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:squidguard, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 10/22/2009

Vulnerability Publication Date: 10/15/2009

Reference Information

CVE: CVE-2009-3700, CVE-2009-3826

CWE: 119

Detections

Analytics