{"id":110781,"date":"2023-10-12T15:10:52","date_gmt":"2023-10-12T13:10:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny"},"modified":"2023-10-12T15:10:52","modified_gmt":"2023-10-12T13:10:52","slug":"v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","title":{"rendered":"N\u00eb serverin proxy Squid jan\u00eb zbuluar 55 vulnerabilitete, 35 nga t\u00eb cilat ende nuk jan\u00eb rregulluar.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb publikuar rezultatet e nj\u00eb auditimi t\u00eb pavarur t\u00eb siguris\u00eb s\u00eb proksy-serverit t\u00eb hapur me cache Squid, t\u00eb zhvilluar n\u00eb vitin 2021. Gjat\u00eb verifikimit t\u00eb kodit t\u00eb projektit jan\u00eb identifikuar 55 vulnerabilitete, prej t\u00eb cilave aktualisht 35 probleme akoma nuk jan\u00eb rregulluar nga zhvilluesit (0-day). Zhvilluesit e Squid jan\u00eb njoftuar p\u00ebr problemet dy vjet e gjysm\u00eb m\u00eb par\u00eb, por nuk e kan\u00eb p\u00ebrfunduar ende pun\u00ebn p\u00ebr zgjidhjen e tyre. N\u00eb fund, autori i auditit vendosi t\u00eb zbuloj\u00eb informacionin pa pritur q\u00eb t\u00eb rregullohen t\u00eb gjitha problemet dhe e njoftoi paraprakisht k\u00ebt\u00eb zhvilluesit e Squid. <\/p>\n
Mes vulnerabiliteteve t\u00eb identifikuara: <\/p>\n
\n
P\u00ebrmbushja e stack-ut n\u00eb zbatimin e autentifikimit me hash (Digest Authentication) q\u00eb shfaqet gjat\u00eb p\u00ebrpunimit t\u00eb HTTP-header-it Proxy-Authorization me nj\u00eb vler\u00eb shum\u00eb t\u00eb madhe n\u00eb fush\u00ebn \u00abDigest nc\u00bb.\n
Qasje n\u00eb memorje pas \u00e7lirimit t\u00eb saj n\u00eb menaxherin e k\u00ebrkesave me metod\u00ebn TRACE.\n
Qasja n\u00eb memorie pas \u00e7lirimit t\u00eb saj gjat\u00eb p\u00ebrpunimit t\u00eb HTTP-k\u00ebrkesave me header-in \u00abRange\u00bb (CVE-2021-31807).\n
Teprimi i stack-ut gjat\u00eb p\u00ebrpunimit t\u00eb header-it HTTP X-Forwarded-For.\n
Teprimi i stack-ut gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave chunked.\n
Qasje n\u00eb memorje pas \u00e7lirimit t\u00eb saj n\u00eb nd\u00ebrfaqen web t\u00eb CacheManager.\n
Teprimi i numrave t\u00eb plot\u00eb n\u00eb menaxherin e header-it HTTP Range (CVE-2021-31808).\n
Qasje n\u00eb memorje pas \u00e7lirimit t\u00eb saj dhe teprimi i buffers n\u00eb menaxherin e shprehjeve ESI (Edge Side Includes).\n
Numra t\u00eb shumt\u00eb gjymtimesh t\u00eb memorjes, dalje jasht\u00eb kufijve t\u00eb buffer-it gjat\u00eb leximit dhe probleme q\u00eb \u00e7ojn\u00eb n\u00eb d\u00ebshtim. <\/ul>\n