AOH :: HP Unsorted S :: BT-21880.HTM

squidGuard 1.3 & 1.4 : buffer overflow
squidGuard 1.3 & 1.4 : buffer overflow
squidGuard 1.3 & 1.4 : buffer overflow


Date		2009-10-26
Program		squidGuard
Found by	Matthieu BOUTHORS

Application description

SquidGuard is a URL redirector used to use blacklists with the proxysoftware
Squid. There are two big advantages to squidguard: it is fast and it is free.
SquidGuard is published under GNU Public License.

Vulnerability description

Multiple buffer overflow can lead to filtering policy bypass and DoS.

The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CVE-2009-3700 to this issue. This is a candidate for
inclusion in the CVE list (, which standardizes 
names for security problems.

Vulnerability details

The vulnerability is due to insecure buffer handling.

For instance in sgLog.c :

 if(vsprintf(msg, format, ap) > (MAX_BUF - 1))

This piece of code may cause a buffer overflow and detects when it's too late.
squidGuard only logs URL with patched bypass attempts (for instance, trailing
dot or double dash, see 

MAX_BUF is 4096, squid does not allow URL greater than 4096 characters.
So in order to cause a buffer overflow, the attacker has to use an URL close to
4096 characters. A succesfull attackers would put squidGuard in emergency mode,
in this mode squidGuard approve each requests. A less succesfull attacker can
freeze the squidGuard instance, reproduct this attack can lead to a DoS.

Systems affected

squidGuard 1.3
squidGuard 1.4


Two patches has been released by the squidGuard team : Patch-20091015 and

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to