APP: Squid Proxy Host Header Bypass Technique

This signature detects attempts to bypass a filtering proxy. Squid Proxy, an open-source proxy project, contains a flaw that allows a crafted HTTP request to bypass the proxy. Since McAfee Web Gateway utilizes Squid, it is also vulnerable to this bypass technique. A successful attack would result in a bypass of your organization's proxy, which could allow the exfiltration of sensitive data, or the access of malicious code on a website, normally blocked by the proxy, which could execute arbitrary code on endpoint systems.

Extended Description

Squid Proxy is prone to a security-bypass vulnerability because it fails to properly enforce filtering rules. A successful attack will allow an attacker to bypass intended security restrictions; this may aid in other attacks. Squid Proxy 3.1.19 is vulnerable; other versions may also be affected. Note: This BID is being retired; the issue can not be exploited as described.

Affected Products

Squid web_proxy_cache

References

BugTraq: 53015 53024

URL: http://www.mcafee.com/ http://www.squid-cache.org/

Short Name

APP:PROXY:SQUID-HOST-HDR-BYPASS

Severity

Minor

Recommended

False

Recommended Action

None

APP: Squid Proxy Host Header Bypass Technique

Extended Description

Affected Products

References

Found a potential security threat?