Re: [PATCH] squid: CVE-2016-4554

[akuster808 <akuster808@gmail.com>]

ping

On 05/30/2016 02:17 AM, Catalin Enache wrote:
> mime_header.cc in Squid before 3.5.18 allows remote attackers
> to bypass intended same-origin restrictions and possibly
> conduct cache-poisoning attacks via a crated HTTP Host header,
> aka a header smuggling issue.
> 
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4554
> 
> Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
> ---
>  .../squid/files/CVE-2016-4554.patch                | 35 ++++++++++++++++++++++
>  .../recipes-daemons/squid/squid_3.5.7.bb           |  1 +
>  2 files changed, 36 insertions(+)
>  create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch
> 
> diff --git a/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch
> new file mode 100644
> index 0000000..c02b67e
> --- /dev/null
> +++ b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch
> @@ -0,0 +1,35 @@
> +From a5d62fe9d7326b8aef2ebcb700d4a228c8b2681a Mon Sep 17 00:00:00 2001
> +From: Catalin Enache <catalin.enache@windriver.com>
> +Date: Thu, 26 May 2016 10:31:48 +0300
> +Subject: [PATCH] Require exact match in Host header name lookup
> +
> +Upstream-Status: Backport
> +CVE: CVE-2016-4554
> +
> +Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
> +---
> + src/mime_header.cc | 6 +++---
> + 1 file changed, 3 insertions(+), 3 deletions(-)
> +
> +diff --git a/src/mime_header.cc b/src/mime_header.cc
> +index 4190b37..db18764 100644
> +--- a/src/mime_header.cc
> ++++ b/src/mime_header.cc
> +@@ -36,11 +36,11 @@ mime_get_header_field(const char *mime, const char *name, const char *prefix)
> + 
> +     debugs(25, 5, "mime_get_header: looking for '" << name << "'");
> + 
> +-    for (p = mime; *p; p += strcspn(p, "\n\r")) {
> +-        if (strcmp(p, "\r\n\r\n") == 0 || strcmp(p, "\n\n") == 0)
> ++    for (p = mime; *p; p += strcspn(p, "\n")) {
> ++        if (strcmp(p, "\n\r\n") == 0 || strcmp(p, "\n\n") == 0)
> +             return NULL;
> + 
> +-        while (xisspace(*p))
> ++        if (*p == '\n')
> +             ++p;
> + 
> +         if (strncasecmp(p, name, namelen))
> +-- 
> +2.7.4
> +
> diff --git a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb
> index d0e1b16..7fe41ee 100644
> --- a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb
> +++ b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb
> @@ -30,6 +30,7 @@ SRC_URI = "http://www.squid-cache.org/Versions/v${MAJ_VER}/${MIN_VER}/${BPN}-${P
>             file://run-ptest \
>             file://volatiles.03_squid \
>             file://CVE-2016-3947.patch \
> +           file://CVE-2016-4554.patch \
>  "
>  
>  LIC_FILES_CHKSUM = "file://COPYING;md5=c492e2d6d32ec5c1aad0e0609a141ce9 \
>