Re: [squid-users] Cache poisoning vulnerability 3.5.23

2017-07-26 Thread Omid Kosari
Amos Jeffries wrote > Cache poisoning (if it is that) is a serious security issue. Please > bring the details of security problems to the *squid-bugs* mailing list > so it can be investigated and solved, rather than blind-siding everyone > with a public announcement like this. > > Amos I tried

Re: [squid-users] Cache poisoning vulnerability 3.5.23

2017-07-26 Thread Amos Jeffries
On 26/07/17 23:33, Omid Kosari wrote: By my experience if you see any output from following command you may be a victim grep -a 'generate_204' /var/log/squid/access.log | grep -v '/204 ' | grep -v '/000' | grep -v opera | grep -v ucweb | grep -v apple OR, you have Android clients on your netw

Re: [squid-users] Cache poisoning vulnerability 3.5.23

2017-07-26 Thread Omid Kosari
By my experience if you see any output from following command you may be a victim grep -a 'generate_204' /var/log/squid/access.log | grep -v '/204 ' | grep -v '/000' | grep -v opera | grep -v ucweb | grep -v apple -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.

[squid-users] Cache poisoning vulnerability 3.5.23

2017-07-26 Thread Omid Kosari
Hello, Recently i have seen some Cache poisoning specially on android captive portal detection sites . My squid was 3.5.19 (from https://packages.debian.org/stretch/squid) on Ubuntu Linux 16.04 . Then i have upgraded to latest version 3.5.23 (from https://packages.debian.org/stretch/squid) and pur