{"id":110781,"date":"2023-10-12T15:10:52","date_gmt":"2023-10-12T13:10:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny"},"modified":"2023-10-12T15:10:52","modified_gmt":"2023-10-12T13:10:52","slug":"v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-proksi-servere-squid-vyyavleno-55-uyazvimostej-35-iz-kotoryh-poka-ne-ispravleny","title":{"rendered":"N\u00eb serverin proxy Squid jan\u00eb zbuluar 55 dob\u00ebsi, 35 t\u00eb cilat ende nuk jan\u00eb korrigjuar.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb publikuar rezultatet e nj\u00eb auditi t\u00eb pavarur t\u00eb siguris\u00eb s\u00eb proxy serverit t\u00eb hapur Squid, t\u00eb kryer n\u00eb vitin 2021. Gjat\u00eb kontrollit t\u00eb baz\u00ebs s\u00eb kodit t\u00eb projektit jan\u00eb identifikuar 55 dob\u00ebsi, nga t\u00eb cilat aktualisht 35 probleme ende nuk jan\u00eb rregulluar nga zhvilluesit (0-day). Zhvilluesit e Squid u njoftuan p\u00ebr problemet dy e gjysm\u00eb vjet m\u00eb par\u00eb, por nuk e p\u00ebrfunduan pun\u00ebn p\u00ebr zgjidhjen e tyre. N\u00eb fund, autori i auditit vendosi t\u00eb zbuloj\u00eb informacionin pa pritur zgjidhjen e t\u00eb gjitha problemeve dhe e njoftoi paraprakisht k\u00ebt\u00eb zhvilluesit e Squid. <\/p>\n
Nd\u00ebr dob\u00ebsit\u00eb e identifikuara: <\/p>\n
\n
Tehnik\u00eb e thell\u00eb p\u00ebr tejkalimin e stack-ut n\u00eb implementimin e autentifikimit me hash (Digest Authentication), e cila paraqitet gjat\u00eb p\u00ebrpunimit t\u00eb titullit HTTP Proxy-Authorization me nj\u00eb vler\u00eb t\u00eb tep\u00ebrt p\u00ebr fush\u00ebn \"Digest nc\".\n
Qasja n\u00eb memorie pas lirimit t\u00eb saj n\u00eb menaxherin e k\u00ebrkesave me metod\u00ebn TRACE.\n
Referenc\u00eb n\u00eb memorie pas \u00e7lirimit t\u00eb saj gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave HTTP me titullin \"Range\" (CVE-2021-31807).\n
Mbytje e stack-ut gjat\u00eb p\u00ebrpunimit t\u00eb titullit HTTP X-Forwarded-For.\n
Mbytje e stack-ut gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave chunked.\n
Qasja n\u00eb memorie pas lirimit t\u00eb saj n\u00eb nd\u00ebrfaqen web t\u00eb CacheManager.\n
Mbytje e numrit t\u00eb plot\u00eb n\u00eb menaxherin e titullit HTTP Range (CVE-2021-31808).\n
Qasja n\u00eb memorie pas lirimit t\u00eb saj dhe mbytje e bufit n\u00eb menaxherin e shprehjeve ESI (Edge Side Includes).\n
Numra t\u00eb shumt\u00eb leak-e t\u00eb memories, dalje jasht\u00eb kufijve t\u00eb bufit gjat\u00eb leximit dhe probleme q\u00eb \u00e7ojn\u00eb n\u00eb p\u00ebrfundim t\u00eb paplanifikuar. <\/ul>\n