AOH :: HP Unsorted S :: BX2191.HTM

Squid Analysis Report Generator <= buffer overflow
Squid Analysis Report Generator <= buffer overflow
Squid Analysis Report Generator <= buffer overflow

=====================================================================Squid Analysis Report Generator <= buffer overflow
Author:          L4teral 
Impact:          buffer overflow
Status:          fixed version available

Affected software description:

Application:     Squid Analysis Report Generator
Version:         <=

Squid Analysis Report Generator is a tool that allow you to view
"where" your users are going to on the Internet.


Execution of arbitrary code is possible by executing sarg with
specially crafted squid log files (access and useragent log).

The access.log has to be manually created to trigger the exploit,
as squid will not allow malformed HTTP methods.

The useragent log is more critical, as this vulnerability can be
exploited by just passing the useragent string within a request
to the squid proxy.


Edit a normal access log and set the request method to an overly long

Edit a normal useragent log and set the useragent field to an overly
long string or send a request to the Squid proxy server passing an
overly long string as useragent in the HTTP header.


Upgrade to version 2.2.4 or higher.


2008-01-28 - vendor informed
2008-01-28 - vendor responded
2008-03-02 - vendor released new version
2008-03-03 - public disclosure

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to