From owner-svn-ports-head@freebsd.org Mon Jul 6 17:31:22 2015 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6CBEA99421C; Mon, 6 Jul 2015 17:31:22 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 41A7537CE; Mon, 6 Jul 2015 17:31:22 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.70]) by repo.freebsd.org (8.14.9/8.14.9) with ESMTP id t66HVL5O083128; Mon, 6 Jul 2015 17:31:21 GMT (envelope-from feld@FreeBSD.org) Received: (from feld@localhost) by repo.freebsd.org (8.14.9/8.14.9/Submit) id t66HVLDj083126; Mon, 6 Jul 2015 17:31:21 GMT (envelope-from feld@FreeBSD.org) Message-Id: <201507061731.t66HVLDj083126@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: feld set sender to feld@FreeBSD.org using -f From: Mark Felder Date: Mon, 6 Jul 2015 17:31:21 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r391429 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 17:31:22 -0000 Author: feld Date: Mon Jul 6 17:31:21 2015 New Revision: 391429 URL: https://svnweb.freebsd.org/changeset/ports/391429 Log: Document recent squid vulnerabilities PR: 201374 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Jul 6 17:24:09 2015 (r391428) +++ head/security/vuxml/vuln.xml Mon Jul 6 17:31:21 2015 (r391429) @@ -57,6 +57,89 @@ Notes: --> + + squid -- multiple vulnerabilities + + + squid + 3.53.5.6 + + + + +

Amos Jeffries, Squid-3 release manager, reports:

+
Due to incorrect handling of peer responses in a hierarchy of 2 or + more proxies remote clients (or scripts run on a client) are able to + gain unrestricted access through a gateway proxy to its backend + proxy.
+
If the two proxies have differing levels of security this could + lead to authentication bypass or unprivileged access to supposedly + secure resources.
+
Squid up to and including 3.5.5 are apparently vulnerable to DoS + attack from malicious clients using repeated TLS renegotiation + messages. This has not been verified as it also seems to require + outdated (0.9.8l and older) OpenSSL libraries.
+

+ + + + http://openwall.com/lists/oss-security/2015/07/06/8 + + + 2015-07-06 + 2015-07-06 + + + + + squid -- client-first SSL-bump does not correctly validate X509 server certificate + + + squid + 3.53.5.4 + 3.43.4.13 + + + squid33 + 3.33.3.14 + + + squid32 + 3.23.2.14 + + + + +

Squid security advisory 2015:1 reports:

+
Squid configured with client-first SSL-bump does not correctly + validate X509 server certificate domain / hostname fields.
+
The bug is important because it allows remote servers to bypass + client certificate validation. Some attackers may also be able + to use valid certificates for one domain signed by a global + Certificate Authority to abuse an unrelated domain.
+
However, the bug is exploitable only if you have configured + Squid to perform SSL Bumping with the "client-first" or "bump" + mode of operation.
+
Sites that do not use SSL-Bump are not vulnerable.
+
All Squid built without SSL support are not vulnerable to the + problem.
+

The FreeBSD port does not use SSL by default and is not vulnerable + in the default configuration.

+ + + + CVE-2015-3455 + http://www.squid-cache.org/Advisories/SQUID-2015_1.txt + + + 2015-05-01 + 2015-07-06 + + + ansible -- multiple vulnerabilities