VULHUB ™

There is a vulnerability present in certain versions of the Squid Web Proxy Cache developed by the National Science Foundation. This problem is only in effect when users of the cache are using an external authenticator. The following is quoted from the original Bugtraq posting on this issue. This message in its entirety is available in the 'Credits' section of this vulnerability. "After decoding the base64 encoded "user:password" pair given by the client, squid doesn't strip out any '\n' or '\r' found in the resulting string. Given such a string, any external authenticator will receive two lines instead of one, and most probably send two results. Now, any subsequent authentication exchange will has its answer shifted by one. Therefore, a malicious user can gain access to sites he or she should not have access to."

There is a vulnerability present in certain versions of the Squid Web Proxy Cache developed by the National Science Foundation. This problem is only in effect when users of the cache are using an external authenticator. The following is quoted from the original Bugtraq posting on this issue. This message in its entirety is available in the 'Credits' section of this vulnerability. "After decoding the base64 encoded "user:password" pair given by the client, squid doesn't strip out any '\n' or '\r' found in the resulting string. Given such a string, any external authenticator will receive two lines instead of one, and most probably send two results. Now, any subsequent authentication exchange will has its answer shifted by one. Therefore, a malicious user can gain access to sites he or she should not have access to."