Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Specially crafted DNS packets can compromise the popular Squid web proxy/cache in such a way that it briefly fails to respond. The problem is caused by insufficiently checked DNS responses which Squid initially places in a queue. By sending packets that only contain a header, a queue overflow can be triggered which can apparently be exploited for Denial-of-Service (DoS) attacks.. The flaw can be exploited both from internal clients and from external DNS servers. The problem has been known since the most recent Chaos Communication Congress (26c3), where Fabian Yamaguchi described the details of this, as well as further flaws in other applications, in his presentation entitled "cat /proc/sys/net/ipv4/fuckups"PDF. Versions 2.x, 3.0 up to and including 3.0.STABLE21, and Squid 3.1 up to and including 3.1.0.15 are affected. In versions 3.0.STABLE22 and 3.1.0.16 of Squid, the flaw has been fixed. A patch is also available. The link for this article located at H Security is no longer available. . The flaw can be exploited both from internal clients and from external DNS servers. The problem has . specially, crafted, packets, compromise, popular, squid, proxy/cache. . LinuxSecurity.com Team
Vendors have not issued updates yet for a vulnerability just reported by the Squid Project. "Under some conditions Squid may forward the proxy authentication credentails. This can happen if you normally require your users to log in to use the proxy, but allow some sites to be reached without needing to log in.". . . . Vendors have not issued updates yet for a vulnerability just reported by the Squid Project. "Under some conditions Squid may forward the proxy authentication credentails. This can happen if you normally require your users to log in to use the proxy, but allow some sites to be reached without needing to log in." synopsis under some conditions Squid may forward the proxy authentication credentails. This can happen if you normally require your users to log in to use the proxy, but allow some sites to be reached without needing to log in. This patch restricts such forwarding to only your configured cache_peers. If you need to further control the credentials forwarding then upgrading to Squid-2.5 is recommended as the forwarding is controlled per cache_peer in Squid-2.5 and later. versions 2.4.STABLE6 and earlier platforms All reported by Hernan Otero configuration if a mixture of proxy authentication and sites not requiring authentication is used. patch squid-2.4.STABLE6-proxy_auth.patch workaround If you use proxy authentication, make sure to use it on all requests. Do not allow access to some sites without the need to log in. . Identified flaw in Squid enables unsafe transmission of proxy authentication details in specific scenarios.. Insecure Proxy Authentication, Squid Vulnerability, Credential Management. . LinuxSecurity.com Team
For some time at my workplace we've been running an ad-zapping service on our web proxy. This page documents how it works, how to use it yourself, how to join the mailing list for updates of the pattern file, and the weirdnesses of our local setup (which you need not duplicate yourself).. . .. For some time at my workplace we've been running an ad-zapping service on our web proxy. This page documents how it works, how to use it yourself, how to join the mailing list for updates of the pattern file, and the weirdnesses of our local setup (which you need not duplicate yourself). Ad zapping is not a new idea. Basicly you interpose between the reader and the web some kind of filter which replaces those annoying ad banners with something unobtrusive. (There are a few motivations for this; see this digression for mine.) The link for this article located at Cameron Simpson is no longer available. . Explore how to configure ad-zapping on your Squid web proxy for enhanced browsing. Details on usage and service setup provided.. Ad Zapping, Web Proxy Configuration, Squid Filter, Internet Privacy, Online Ads. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.