CVE-1999-1481

Description

Squid 2.2.STABLE5 and below, when using external authentication, allows attackers to bypass access controls via a newline in the user/password pair.

Affected products

• national_science_foundation / squid_web_proxy1.0 – 1.0
• national_science_foundation / squid_web_proxy1.0novm – 1.0novm
• national_science_foundation / squid_web_proxy1.1 – 1.1
• national_science_foundation / squid_web_proxy2.1 – 2.1
• national_science_foundation / squid_web_proxy2.2 – 2.2

Exploits & proofs of concept

• exploit-dbNational Science Foundation Squid Web Proxy 1.0/1.1/2.1 - Authentication Failureby Oezguer Kesim

References

• MISChttp://www.securityfocus.com/archive/1/33295
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/3433
• MISChttp://www.squid-cache.org/Versions/v2/2.2/bugs/
• MISChttp://www.securityfocus.com/bid/741
• MISChttp://www.securityfocus.com/archive/1/33295