Gentoo Archives: gentoo-security

From: Tarragon Allen <lists@××××××××.com>
To: gentoo-security@l.g.o
Subject: Re: [gentoo-security] any squid/squidguard users that can help test a possible exploit?
Date: Wed, 21 Apr 2004 02:13:06
Message-Id: 200404211211.46654.lists@n12turbo.com
1 Spam detection software, running on the system "mailcluster2", has
2 identified this incoming email as possible spam. The original message
3 has been attached to this so you can view it (if it isn't spam) or block
4 similar future email. If you have any questions, see
5 the administrator of that system for details.
6
7 Content preview: On Tuesday 20 April 2004 21:28, Kurt Lieber wrote: > We
8 have an outstanding bug for squidguard that discusses an exploit for >
9 potentially bypassing squidguard's ACLs: > >
10 http://bugs.gentoo.org/show_bug.cgi?idE491 > > A proof-of-concept is
11 supplied. > > We really need someone to test this and report back on if
12 it is, in fact, > an issue. > > Anyone out there that can help us with
13 this? [...]
14
15 Content analysis details: (5.5 points, 5.0 required)
16
17 pts rule name description
18 ---- ---------------------- --------------------------------------------------
19 2.4 HTTP_ESCAPED_HOST URI: Uses %-escapes inside a URL's hostname
20 3.1 USERPASS URI: URL contains username and (optional) password