mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crated HTTP Host header, aka a header smuggling issue.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4554 Signed-off-by: Catalin Enache <[email protected]> --- .../squid/files/CVE-2016-4554.patch | 35 ++++++++++++++++++++++ .../recipes-daemons/squid/squid_3.5.7.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch diff --git a/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch new file mode 100644 index 0000000..c02b67e --- /dev/null +++ b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch @@ -0,0 +1,35 @@ +From a5d62fe9d7326b8aef2ebcb700d4a228c8b2681a Mon Sep 17 00:00:00 2001 +From: Catalin Enache <[email protected]> +Date: Thu, 26 May 2016 10:31:48 +0300 +Subject: [PATCH] Require exact match in Host header name lookup + +Upstream-Status: Backport +CVE: CVE-2016-4554 + +Signed-off-by: Catalin Enache <[email protected]> +--- + src/mime_header.cc | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/mime_header.cc b/src/mime_header.cc +index 4190b37..db18764 100644 +--- a/src/mime_header.cc ++++ b/src/mime_header.cc +@@ -36,11 +36,11 @@ mime_get_header_field(const char *mime, const char *name, const char *prefix) + + debugs(25, 5, "mime_get_header: looking for '" << name << "'"); + +- for (p = mime; *p; p += strcspn(p, "\n\r")) { +- if (strcmp(p, "\r\n\r\n") == 0 || strcmp(p, "\n\n") == 0) ++ for (p = mime; *p; p += strcspn(p, "\n")) { ++ if (strcmp(p, "\n\r\n") == 0 || strcmp(p, "\n\n") == 0) + return NULL; + +- while (xisspace(*p)) ++ if (*p == '\n') + ++p; + + if (strncasecmp(p, name, namelen)) +-- +2.7.4 + diff --git a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb index d0e1b16..7fe41ee 100644 --- a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb +++ b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb @@ -30,6 +30,7 @@ SRC_URI = "http://www.squid-cache.org/Versions/v${MAJ_VER}/${MIN_VER}/${BPN}-${P file://run-ptest \ file://volatiles.03_squid \ file://CVE-2016-3947.patch \ + file://CVE-2016-4554.patch \ " LIC_FILES_CHKSUM = "file://COPYING;md5=c492e2d6d32ec5c1aad0e0609a141ce9 \ -- 2.7.4 -- _______________________________________________ Openembedded-devel mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-devel
