CVE-2004-0832 in Squid
Summary
by MITRE
The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/05/2019
The vulnerability described in CVE-2004-0832 represents a critical buffer over-read condition affecting Squid proxy server versions 2.5.6 and earlier when NTLM authentication is enabled. This flaw exists within the ntlm_fetch_string and ntlm_get_string functions that process NTLM Security Support Provider (NTLMSSP) packets during authentication negotiations. The vulnerability stems from improper input validation and parameter handling within the NTLM authentication processing logic, creating a scenario where maliciously crafted NTLMSSP packets can trigger unexpected behavior in the application's memory management routines.
The technical exploitation of this vulnerability occurs when an attacker sends specially crafted NTLMSSP packets that contain negative values in specific fields that are subsequently passed as parameters to the memcpy function. This function requires a positive integer value for its size parameter, and when a negative value is provided, it causes undefined behavior that typically results in memory corruption. The negative value originates from improper parsing or calculation within the NTLM authentication handling code, where input data from the network is not properly validated before being used in memory operations.
From an operational perspective, this vulnerability presents a significant denial of service threat to systems relying on Squid as a proxy server with NTLM authentication enabled. The impact extends beyond simple service disruption as the application crash can occur unpredictably, potentially affecting legitimate users while the service remains unavailable. The vulnerability is particularly concerning because it requires no authentication to exploit and can be triggered by any remote attacker who can establish a connection to the affected Squid server. This makes it a prime candidate for automated exploitation and can be leveraged in larger attack campaigns targeting proxy infrastructure.
The vulnerability aligns with CWE-129, which describes improper validation of length parameters, and CWE-128, which covers over-read conditions. From an ATT&CK framework perspective, this vulnerability maps to T1499.004, specifically focusing on network denial of service attacks, and potentially T1566.001 for initial access through network services. The exploitation pattern demonstrates a classic buffer manipulation attack where malformed input leads to memory corruption. Organizations should implement immediate mitigations including updating to Squid versions 2.5.7 or later, disabling NTLM authentication if not required, and implementing network-level filtering to restrict access to NTLM authentication endpoints. Additionally, monitoring for unusual authentication traffic patterns and implementing proper input validation at network boundaries can help detect and prevent exploitation attempts.