ping
On 05/30/2016 02:17 AM, Catalin Enache wrote: > mime_header.cc in Squid before 3.5.18 allows remote attackers > to bypass intended same-origin restrictions and possibly > conduct cache-poisoning attacks via a crated HTTP Host header, > aka a header smuggling issue. > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4554 > > Signed-off-by: Catalin Enache <[email protected]> > --- > .../squid/files/CVE-2016-4554.patch | 35 > ++++++++++++++++++++++ > .../recipes-daemons/squid/squid_3.5.7.bb | 1 + > 2 files changed, 36 insertions(+) > create mode 100644 > meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch > > diff --git a/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch > b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch > new file mode 100644 > index 0000000..c02b67e > --- /dev/null > +++ b/meta-networking/recipes-daemons/squid/files/CVE-2016-4554.patch > @@ -0,0 +1,35 @@ > +From a5d62fe9d7326b8aef2ebcb700d4a228c8b2681a Mon Sep 17 00:00:00 2001 > +From: Catalin Enache <[email protected]> > +Date: Thu, 26 May 2016 10:31:48 +0300 > +Subject: [PATCH] Require exact match in Host header name lookup > + > +Upstream-Status: Backport > +CVE: CVE-2016-4554 > + > +Signed-off-by: Catalin Enache <[email protected]> > +--- > + src/mime_header.cc | 6 +++--- > + 1 file changed, 3 insertions(+), 3 deletions(-) > + > +diff --git a/src/mime_header.cc b/src/mime_header.cc > +index 4190b37..db18764 100644 > +--- a/src/mime_header.cc > ++++ b/src/mime_header.cc > +@@ -36,11 +36,11 @@ mime_get_header_field(const char *mime, const char > *name, const char *prefix) > + > + debugs(25, 5, "mime_get_header: looking for '" << name << "'"); > + > +- for (p = mime; *p; p += strcspn(p, "\n\r")) { > +- if (strcmp(p, "\r\n\r\n") == 0 || strcmp(p, "\n\n") == 0) > ++ for (p = mime; *p; p += strcspn(p, "\n")) { > ++ if (strcmp(p, "\n\r\n") == 0 || strcmp(p, "\n\n") == 0) > + return NULL; > + > +- while (xisspace(*p)) > ++ if (*p == '\n') > + ++p; > + > + if (strncasecmp(p, name, namelen)) > +-- > +2.7.4 > + > diff --git a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb > b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb > index d0e1b16..7fe41ee 100644 > --- a/meta-networking/recipes-daemons/squid/squid_3.5.7.bb > +++ b/meta-networking/recipes-daemons/squid/squid_3.5.7.bb > @@ -30,6 +30,7 @@ SRC_URI = > "http://www.squid-cache.org/Versions/v${MAJ_VER}/${MIN_VER}/${BPN}-${P > file://run-ptest \ > file://volatiles.03_squid \ > file://CVE-2016-3947.patch \ > + file://CVE-2016-4554.patch \ > " > > LIC_FILES_CHKSUM = "file://COPYING;md5=c492e2d6d32ec5c1aad0e0609a141ce9 \ > -- _______________________________________________ Openembedded-devel mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-devel
