Squid May Disclose Random Internal Information to Remote Users
Categorie: Vulnerability Posted: 2004-12-11 by ReCall Views: 492 Source: Click here
Current Rating: Not rated
Details
Description: A vulnerability was reported in Squid. A remote user may be able to obtain random internal information from the target server.
Artur Szostak reported that a remote user can submit a sequence of malformed hostnames to trigger failed DNS lookups to cause the target Squid server to return random data as error messages. The random data may contain data from other requests.
A demonstration exploit request is provided:
http://./.gz/
Impact: A remote user may be able to obtain random internal information from the target server.
