Description
Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.4.7 | — |
| Debian 13 | squid | 2.4.7 | — |
| Debian 12 | squid | 2.4.7 | — |
References
- 20020603 [VulnWatch] [DER #11] - Remotey exploitable fmt string bug in squid mailing-list
- msntauth-squid-format-string(9248) vdb-entry
- http://www.squid-cache.org/Versions/v2/2.4/diff-2.4.STABLE6-2.4.STABLE7.gz
- 20020604 [DER #11] - Remotey exploitable fmt string bug in squid mailing-list
- 4929 vdb-entry