[oe] [PATCH] squid: CVE-2016-4554
akuster808
akuster808 at gmail.com
Thu Jul 14 14:32:49 UTC 2016
ping
On 05/30/2016 02:17 AM, Catalin Enache wrote:
> mime_header.cc in Squid before 3.5.18 allows remote attackers
> to bypass intended same-origin restrictions and possibly
> conduct cache-poisoning attacks via a crated HTTP Host header,
> aka a header smuggling issue.
>
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4554
>
> Signed-off-by: Catalin Enache <catalin.enache at windriver.com>
> ---
> .../squid/files/CVE-2016-4554.patch | 35 ++++++++++++++++++++++
> .../recipes-daemons/squid/squid_3.5.7.bb | 1 +
> 2 files changed, 36 insertions(+)
> create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch
>
> diff --git a/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch
> new file mode 100644
> index 0000000..c02b67e
> --- /dev/null
> +++ b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch
> @@ -0,0 +1,35 @@
> +From a5d62fe9d7326b8aef2ebcb700d4a228c8b2681a Mon Sep 17 00:00:00 2001
> +From: Catalin Enache <catalin.enache at windriver.com>
> +Date: Thu, 26 May 2016 10:31:48 +0300
> +Subject: [PATCH] Require exact match in Host header name lookup
> +
> +Upstream-Status: Backport
> +CVE: CVE-2016-4554
> +
> +Signed-off-by: Catalin Enache <catalin.enache at windriver.com>
> +---
> + src/mime_header.cc | 6 +++---
> + 1 file changed, 3 insertions(+), 3 deletions(-)
> +
> +diff --git a/src/mime_header.cc b/src/mime_header.cc
> +index 4190b37..db18764 100644
> +--- a/src/mime_header.cc
> ++++ b/src/mime_header.cc
> +@@ -36,11 +36,11 @@ mime_get_header_field(const char *mime, const char *name, const char *prefix)
> +
> + debugs(25, 5, "mime_get_header: looking for '" << name << "'");
> +
> +- for (p = mime; *p; p += strcspn(p, "\n\r")) {
> +- if (strcmp(p, "\r\n\r\n") == 0 || strcmp(p, "\n\n") == 0)
> ++ for (p = mime; *p; p += strcspn(p, "\n")) {
> ++ if (strcmp(p, "\n\r\n") == 0 || strcmp(p, "\n\n") == 0)
> + return NULL;
> +
> +- while (xisspace(*p))
> ++ if (*p == '\n')
> + ++p;
> +
> + if (strncasecmp(p, name, namelen))
> +--
> +2.7.4
> +
> diff --git a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb
> index d0e1b16..7fe41ee 100644
> --- a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb
> +++ b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb
> @@ -30,6 +30,7 @@ SRC_URI = "http://www.squid-cache.org/Versions/v${MAJ_VER}/${MIN_VER}/${BPN}-${P
> file://run-ptest \
> file://volatiles.03_squid \
> file://CVE-2016-3947.patch \
> + file://CVE-2016-4554.patch \
> "
>
> LIC_FILES_CHKSUM = "file://COPYING;md5=c492e2d6d32ec5c1aad0e0609a141ce9 \
>
More information about the Openembedded-devel
mailing list