squid -- no sanity check of usernames in squid_ldap_auth

Description:

The LDAP authentication helper did not strip leading or trailing spaces from the login name. According to the squid patches page:

LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access controls or confusing accounting.

Workaround: Block logins with spaces

	    acl login_with_spaces proxy_auth_regex [:space:]
		    http_access deny login_with_spaces
	    

References:

• CVE name CVE-2005-0173
• URL: <http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces>
• URL: <http://www.squid-cache.org/bugs/show_bug.cgi?id=1187>
• CERT vulnerability note 924198

Affects:

• squid <2.5.7_7

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Officer. Refer to "FreeBSD Security Information" for more information.