{"id":110781,"date":"2023-10-12T15:10:52","date_gmt":"2023-10-12T13:10:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny"},"modified":"2023-10-12T15:10:52","modified_gmt":"2023-10-12T13:10:52","slug":"v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","title":{"rendered":"U proxy poslu\u017eitelju Squid otkrivene su 55 ranjivosti, od kojih 35 jo\u0161 nije ispravljeno.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Objavljeni su rezultati neovisne sigurnosne revizije otvorenog proxy poslu\u017eitelja Squid, provedene 2021. godine. Tijekom pregleda kodne baze projekta otkrivene su 55 ranjivosti, od kojih trenutno 35 problema jo\u0161 nije ispravljeno od strane programera (0-day). Programeri Squid su o problemima obavije\u0161teni prije dva i pol godine, ali jo\u0161 uvijek nisu zavr\u0161ili rad na njihovom rje\u0161avanju. Na kraju, autor revizije odlu\u010dio je objaviti informacije prije nego \u0161to su svi problemi ispravljeni i prethodno obavijestio programere Squid.  <\/p>\n<p>Me\u0111u otkrivenim ranjivostima:  <\/p>\n<ul>\n<li class=\"l\"> Prelivanje stoga u implementaciji autentifikacije putem he\u0161a (Digest Authentication), koje se manifestira prilikom obrade HTTP zaglavlja Proxy-Authorization sa prevelikom vrijedno\u0161\u0107u polja \"Digest nc\".\n<li class=\"l\"> Pristup memoriji nakon njenog osloba\u0111anja u handleru zahtjeva s metodom TRACE.\n<li class=\"l\"> Pristup memoriji nakon njezinog osloba\u0111anja prilikom obrade HTTP zahtjeva s zaglavljem \"Range\" (CVE-2021-31807).\n<li class=\"l\"> Preoptere\u0107enje steka prilikom obrade HTTP zaglavlja X-Forwarded-For.\n<li class=\"l\"> Preoptere\u0107enje steka prilikom obrade chunked zahtjeva.\n<li class=\"l\"> Pristup memoriji nakon njenog osloba\u0111anja u web su\u010delju CacheManager.\n<li class=\"l\"> Cjelobrojno preoptere\u0107enje u handleru HTTP zaglavlja Range (CVE-2021-31808).\n<li class=\"l\"> Pristup memoriji nakon njenog osloba\u0111anja i preoptere\u0107enje bafera u handleru izraza ESI (Edge Side Includes).\n<li class=\"l\"> Brojne curenja memorije, izlazi iz granica bafera prilikom \u010ditanja i problemi koji dovode do iznenadnog prekida rada.  <\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59915\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Squid, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0432 2021 \u0433\u043e\u0434\u0443. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0431\u0430\u0437\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 55 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f 35 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u043a\u0430 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 (0-day). \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Squid \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u043e\u0439 \u0433\u043e\u0434\u0430 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0442\u0430\u043a \u0438 \u043d\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u043b\u0438 \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110781","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Squid, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0432 2021 \u0433\u043e\u0434\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Squid \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 55 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, 35 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Squid, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0432 2021 \u0433\u043e\u0434\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-12T13:10:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-12T13:10:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47U proxy poslu\u017eitelju Squid otkrivene su 55 ranjivosti, od kojih 35 jo\u0161 nije ispravljeno | ProHoster","description":"Objavljeni su rezultati neovisne sigurnosne revizije otvorenog proxy poslu\u017eitelja Squid, provedene 2021. godine.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Squid \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 55 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, 35 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Squid, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0432 2021 \u0433\u043e\u0434\u0443.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-12T13:10:52+00:00","article:modified_time":"2023-10-12T13:10:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=110781"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/110781\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=110781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=110781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=110781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}