Project

General

Profile

Actions
Copy link

Bug #6995

closed

Security Issue - SquidAnalyzer

Added by Bruno Kammers over 7 years ago. Updated over 7 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Category:
Dashboard
Target version:
-
Start date:
12/08/2016
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.3.x
Affected Architecture:
All

Description

I found this flaw when I was testing SquidAnalyzer.

I noticed that it is possible to access the URL of the package directly, without going through the authentication.

Ex.: Hot IP - 200.200.200.200

WebConfigurator - https://200.200.200.2009

Squidanalyzer URL - https://200.200.200.200:9443/squidreport

Actions
Copy link
 #1

Updated by Bruno Kammers over 7 years ago

If you open the URL directly, access is accomplished without authentication.

Actions
Copy link
 #2

Updated by Jim Pingle over 7 years ago

  • Status changed from New to Rejected
  • Priority changed from Very High to Normal

There is no pfSense package by that name.

Furthermore, any package that runs its own daemon on an alternate port has to manage its own security -- there isn't anything pfSense can do about that. Packages that use their own GUI files outside of the pfSense GUI framework must also handle their own security.

In those cases, don't expose the affected port to untrusted networks.

Actions
Copy link
 #3

Updated by Kill Bill over 7 years ago

There is no SquidAnalyzer anywhere in pfSense packages. If you are unable to secure random third-party stuff properly, stop installing it on your firewall.

Actions
Copy link

Also available in: Atom PDF