Hi there, I am looking forward for your help, please. Further I tried to get the access log on the same time and I found this: Tue May 27 06:33:20 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html Tue May 27 06:36:20 2014 120834 TCP_MISS/200 1972 CONNECT www.facebook.com:443 - HIER_DIRECT/31.13.64.145 - Tue May 27 06:39:21 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html Tue May 27 06:42:20 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html Tue May 27 06:45:23 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html Tue May 27 06:45:23 2014 1 TCP_MISS/503 3744 GET http://torrentz.eu/i - HIER_NONE/- text/html Tue May 27 06:48:21 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html Tue May 27 06:51:24 2014 203333 TCP_MISS/200 3556 CONNECT www.facebook.com:443 - HIER_DIRECT/31.13.64.81 - Tue May 27 06:51:24 2014 470 TCP_MISS/503 3744 GET http://torrentz.eu/i - HIER_NONE/- text/html Tue May 27 06:51:24 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html Tue May 27 06:54:23 2014 0 TCP_MISS/503 3797 POST http://xdz.no-ip.org:9091/is-ready - HIER_DIRECT/0.0.0.0 text/html And the Store.cc line 915 is saying this /* Append incoming data from a primary server to an entry. */ void StoreEntry::append(char const *buf, int len) { assert(mem_obj != NULL); assert(len >= 0); assert(store_status == STORE_PENDING); StoreIOBuffer tempBuffer; tempBuffer.data = (char *)buf; tempBuffer.length = len; /* * XXX sigh, offset might be < 0 here, but it gets "corrected" * later. This offset crap is such a mess. */ tempBuffer.offset = mem_obj->endOffset() - (getReply() ? getReply()->hdr_sz : 0); write(tempBuffer); } Best Regards, Farooq -----Original Message----- From: Farooq Bhatti [mailto:farooq@xxxxxxxxxxxxxx] Sent: Tuesday, May 27, 2014 12:31 PM To: 'Amos Jeffries'; squid-users@xxxxxxxxxxxxxxx Subject: RE: store.cc crashing the squid child Ahh.. on my backup proxy in which I allow that subnet I was again on attack but this time on the squid version is 3.4.5. Squid Cache: Version 3.4.5 configure options: '--build=x86_64-unknown-linux-gnu' '--host=x86_64-unknown-linux-gnu' '--target=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--with-logdir=$(localstatedir)/log/squid' '--with-pidfile=$(localstatedir)/run/squid.pid' '--disable-dependency-tracking' '--enable-follow-x-forwarded-for' '--enable-auth' '--enable-auth-basic=DB,LDAP,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam' '--enable-auth-ntlm=smb_lm,fake' '--enable-auth-digest=file,LDAP,eDirectory' '--enable-auth-negotiate=kerberos,wrapper' '--enable-external-acl-helpers=wbinfo_group,kerberos_ldap_group,AD_group' '--enable-cache-digests' '--enable-cachemgr-hostname=localhost' '--enable-delay-pools' '--enable-epoll' '--enable-icap-client' '--enable-ident-lookups' '--enable-linux-netfilter' '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-storeio=aufs,diskd,ufs,rock' '--enable-wccpv2' '--enable-esi' '--enable-ssl' '--enable-ssl-crtd' '--enable-icmp' '--with-aio' '--with-default-user=squid' '--with-filedescriptors=65535' '--with-dl' '--with-openssl' '--with-pthreads' '--with-included-ltdl' 'build_alias=x86_64-unknown-linux-gnu' 'host_alias=x86_64-unknown-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -fPIC' 'PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/share/pkgconfig' --enable-ltdl-convenience The syslog is saying below May 27 06:36:22 proxy1 squid[3503]: Squid Parent: (squid-1) process 16614 exited due to signal 6 with status 0 May 27 06:36:25 proxy1 squid[3503]: Squid Parent: (squid-1) process 16672 started May 27 06:39:22 proxy1 squid[3503]: Squid Parent: (squid-1) process 16672 exited due to signal 6 with status 0 May 27 06:39:25 proxy1 squid[3503]: Squid Parent: (squid-1) process 16729 started May 27 06:42:23 proxy1 squid[3503]: Squid Parent: (squid-1) process 16729 exited due to signal 6 with status 0 May 27 06:42:26 proxy1 squid[3503]: Squid Parent: (squid-1) process 16790 started May 27 06:45:23 proxy1 squid[3503]: Squid Parent: (squid-1) process 16790 exited due to signal 6 with status 0 May 27 06:45:26 proxy1 squid[3503]: Squid Parent: (squid-1) process 16847 started May 27 06:48:24 proxy1 squid[3503]: Squid Parent: (squid-1) process 16847 exited due to signal 6 with status 0 May 27 06:48:27 proxy1 squid[3503]: Squid Parent: (squid-1) process 16903 started May 27 06:51:25 proxy1 squid[3503]: Squid Parent: (squid-1) process 16903 exited due to signal 6 with status 0 May 27 06:51:28 proxy1 squid[3503]: Squid Parent: (squid-1) process 16963 started May 27 06:54:25 proxy1 squid[3503]: Squid Parent: (squid-1) process 16963 exited due to signal 6 with status 0 May 27 06:54:28 proxy1 squid[3503]: Squid Parent: (squid-1) process 17019 started The Cache log is saying this and restarting the child every time. 2014/05/27 06:36:21 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" 2014/05/27 06:39:21 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" 2014/05/27 06:42:22 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" 2014/05/27 06:45:23 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" 2014/05/27 06:48:23 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" 2014/05/27 06:51:24 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" 2014/05/27 06:54:24 kid1| assertion failed: store.cc:915: "store_status == STORE_PENDING" Again from access log not been able to point out who could be the culprit of that and further what query made him possible for exploiting this vulnerability of the latest version of squid 3.4.5. Any inside expert opinion to filter such exploiting request. BR Farooq -----Original Message----- From: Amos Jeffries [mailto:squid3@xxxxxxxxxxxxx] Sent: Tuesday, May 27, 2014 10:55 AM To: squid-users@xxxxxxxxxxxxxxx Subject: Re: store.cc crashing the squid child On 27/05/2014 4:32 p.m., Farooq Bhatti wrote: > Hi There, > > Pardon me for long email. Actually I faced a DOS attack in a > university setup and want to get help to avoid it in future. I am > using squid following version > > squid -v > Squid Cache: Version 3.4.3 Could be this: http://www.squid-cache.org/Advisories/SQUID-2014_1.txt Please upgrade to the latest Squid version. Today that is 3.4.5. Amos --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com
