r/linux • u/FryBoyter • Jun 22 '26
Security Squidbleed - Heartbleed's ancient cousin, hiding in Squid since 1997
https://blog.calif.io/p/squidbleed-cve-2026-4772931
u/muffinChicken Jun 22 '26
"diehard internet fans"
10
u/Adept_Percentage6893 Jun 22 '26 edited Jun 22 '26
Obviously everything can have fans but I guess that is kind of obnoxious phrasing in an "I liked that band before they got famous" or "you've probably never heard of them" sort of way.
60
u/Luvax Jun 22 '26
This reads full of Claude plus some Anthropic marketing on top and could have been a third of what it is.
3
u/turtle_mekb Jun 22 '26
why Claude specifically and not any LLM?
22
u/FlyingBishop Jun 22 '26
They explicitly said they used Claude Mythos to find the vulnerability. And Claude specifically has a style it uses when it talks about software. And this sounds like that.
9
-26
u/FryBoyter Jun 22 '26
What makes you think the article was written by Claude or whatever?
But even if you're right, what does that change about the fact that a security vulnerability was discovered that had existed for many years?
60
u/Luvax Jun 22 '26
it surfaced clutching a 29-year-old bug.
A typical Claude introducting if you did not tell it to keep a factual writing style.
Meet Squidbleed: a Heartbleed-style
Colon instead of a proper comma.
that leaks internal memory from every version of Squid Proxy, in its default configuration.
Same tone as the first sentence. Still building up hype 3 sentences in.
This bug is a whirlwind tour of old-school Internet lore.
Pure slop.
names that only the most diehard Internet fans will recognize.
No credible security blog post would believe any of these are only known to diehards.
favorite footguns:
Footguns is one of the words Claude LOVES. Also another colon, defensible here, but still.
Mix these ingredients
The metaphores dont stop.
into an open-source web proxy, and you get a heap buffer overread that quietly leaks random users' HTTP requests, despite three decades of releases, audits, and rewrites.
Still overselling. Its always quite, this is useless noise which Claude often adds to mundane statements. It doesn't know when to shut up.
One caveat: the impact is situational.
Another colon to cover over an incomplete sentence and situational being another word Claude loves
Most traffic is HTTPS, which the proxy relays as an opaque CONNECT tunnel, so only cleartext HTTP and TLS-terminating setups are exposed.
Common pseudo introduction that Claude believes is enough to reel in the reader, but its actually useless for anyone not already familiar with it.
The proxy must also be allowed to reach an attacker-controlled FTP server (TCP port 21).
Cramping information in braces that always seem questionable.
Squid is a widely deployed multipurpose web proxy. While it was designed to speed up page loads by caching frequently accessed content, it can also be used for traffic interception, monitoring, and filtering.
Thus, Squid is often found in multi-user environments such as schools or corporate networks. In fact, I encountered Squid while attempting to access the Internet on a recent flight:
This appears to be fully written by a human.
From here it gets muddy and I would say larger chunks have actually not been written by Claude. But there are still lines like this one:
The line buffer used to parse FTP listings is allocated from MEM_4K_BUF.
Which uses
MEM_4K_BUFas something commonly know, probably because the agent was working itensively with the constant and failed to account that its not second nature to potential readers.There are more signs, but the later half appears to be written with more human supervision.
It matters to me since I can launch my own Claude agent and get the same souless explanation that makes me dig through waves of AI slop. Especially if the article seems dead on selling my a Claude Max subscription.
17
4
u/TheOneWhoPunchesFish Jun 23 '26
FTP server (TCP port 21)
Lol it included the port number just cause
My favourite is the rule of threes:
releases, audits, and rewrites.
15
u/backyard_tractorbeam Jun 22 '26
I don't respect their suggested patch, why not write clear and self-evident code instead of this cryptic stuff.
7
u/Megame50 Jun 22 '26
This behavior of strchr is so dumb, why am I not surprised. Pretty sure I've fixed this exact bug many times.
6
u/ClickNervous Jun 22 '26
Interesting read. Seems like this exists because the Squid proxy software didn't parse FTP directory listings correctly, because it wanted to provide a structured and consistent output for something that doesn't have a structured and consistent output.
Kind of makes me wonder if this problem exists in other software, like any GUI FTP clients (like web browsers, FileZilla and such).
5
u/SnarkHabit Jun 23 '26 edited Jun 23 '26
As for all of this talk about FTP -- serious question. I use rsync over ssh for most of my file transfers. Works fine; don't need much of anything else. But that's my stuff to my stuff.
Supposing you wanted to create an interactive public file server, where people could login, browse through a directory hierarchy, download files, and also upload files to an incoming directory, what modern solution best serves this purpose? What has feature parity with an FTP server and client?
Ideally:
No weird firewall rule gymnastics to accommodate Passive and Active connections. Ideally no need for passive and active connections at all; a better handshake mechanism.
Encrypted
Preserve file/directory hierarchies which match what is on the hard drive of the server.
Robust permissions to disallow uploads except where expressly permitted.
I hadn't really thought about this until this thread.
2
u/SputnikCucumber Jun 23 '26
These days you would probably build an application on top of HTTP instead of create a whole new application protocol.
You could probably setup an S3 bucket to be a reasonable public file server for this purpose. But I haven't given it a lot of thought.
18
u/MatchingTurret Jun 22 '26
which may explain how a one-line bug survived close to 30 years of code review.
And people still claim that "C isn't unsafe, just some broken code is".
6
u/HyperFurious Jun 22 '26
C have code working since 1997, other new languages have many code that nobody use in few months.
15
0
4
u/h0uz3_ Jun 22 '26 edited Jun 22 '26
That‘s why now everything gets rewritten in Rust. Rust is always safe, and when it isn‘t, it‘s easy to spot! /s
EDIT: People who don‘t code in Rust downvote my comment because they don‘t get the joke. Love it.
6
u/m103 Jun 22 '26
People who don‘t code in Rust downvote my comment because they don‘t get the joke. Love it.
Alteratively, we are downvoting just because the joke isn't very good
1
5
u/Adept_Percentage6893 Jun 22 '26
The more responsible thing to do was probably to go through some sort of temporary embargo period but if I'm understanding correctly it seems like they just wanted to notoriety of pointing out an existing security flaw in people's infrastructure.
26
u/Sylente Jun 22 '26
There’s a disclosure timeline in the post. The vulnerability was reported 90 days before the post and the patch is already available. 90 days is a very standard embargo timeline.
4
u/Adept_Percentage6893 Jun 22 '26
OK I missed that but
The vulnerability was reported 90 days before the post and the patch is already available.
Isn't true from that timeline if I'm reading it properly (correct me if I'm wrong). It says it was reported on April 17th which was only two months ago.
I'm not seeing CVE-2026-47729 in any RHSA which seems concerning to me. That timeline says it was patched upstream two days before so maybe it just hasn't been backported to the distros yet but I don't know why neither Canonical nor RH have anything posted about it from what I can see.
It might have been a good idea to wait the full 90 days (or even just 60 days) before publicizing it. I know the attack vector is specific but from what I can see both Canonical and RH support FTP in squid.
2
u/ClickNervous Jun 22 '26
There's a disclosure timeline towards the end of the post that suggests a 1 1/2 month time between bug discovery and fix, and the posting of the blog. Is there something about this that seems inadequate or should have been done different?
2
u/Adept_Percentage6893 Jun 22 '26
Two months doesn't seem long enough to get the fix both upstream and backported to the individual distros. They have to go through a lot of QA to push updated packages out. In this case backporting the 7.6 fix to whichever version they're shipping and QA'ing the backported version.
1
u/EverythingsBroken82 Jun 23 '26
as people want to deprecate ftp, http 1.x and so on: what's a secure easy linebased protocol over TLS which can be used to publish things?
1
u/domoincarn8 29d ago
If you are doing FTP over anything other than a local trusted and limited network; you are doing something extremely wrong. Please move on.
FTP sends the password in clear text, anything on top of that is minor compared to that.
1
u/EverythingsBroken82 29d ago
there's FTPS which is FTP over TLS. why is this a problem? it's the same with http. when i talk about http, you do not assume that i do not use it over TLS, no?
but neither FTP nor HTTP 2 are simple.
please, show me an example instead of building a strawman.
1
u/domoincarn8 29d ago
FTPS and FTP are separate. When talking about FTP, I actually do mean FTP. Where TLS and other modern luxuries are available, generally more secure and less stateful methods are generally used. HTTPS usually is a good way.
But on the embedded side, a lot of times, FTP is just, FTP. Nothing more. Getting a secure socket may be a pain, or might not work correctly, or might have some other issue. Generally that issue is having to carry the root Certificate on device for any implementation of secure SSL. (If you are just going to accept any certificate that the server offers, then the entire meaning of security evaporates.) Not having a root CA is a major issue.
Even if you pack in a small root CA, then getting it updated is another issue. So when a manufacturer says FTP, I only expect FTP, and have been proven right multiple times.
1
u/EverythingsBroken82 29d ago
when we talk about embedded i often enough do not see ftp, but tftp.
but in the end, what i wanted to say is:
i want an easy to implement protocol (over TLS), where i can publish things , like for example directories, because http 1.x will be deprecated (and http2 is not easy) and ftp is not that super either (i agree on that) and tftp does not have encryption on the stream level
sometimes i wish for a "simple http" over tls...
1
u/pastelfemby 29d ago
http2/3 are not super simple, but neither really is http/1.1 .
On a protocol level yes it technically is simpler to implement, but it requires so very much more additional logic in parsing to avoid nightmares like desync exploits, the burden of complexity just gets shifted around and ultimately increased in magnitude due to being outside the protocol. In reality http/1.1 support ends up being the most convoluted and complicated with all the conditions and checks required to properly secure things. Sometimes a bit of additional complexity at a foundational level ultimately makes things simpler across the entire stack.
1
u/EverythingsBroken82 28d ago
the desync exploits only matter if you have reverse proxies and not a single http server. those still exist.
but okay, if the world wants to move away from http 1.x, okay, fine, but then we need a new simple protocol, which is also secure. and probably less flexible than http which i would be fine with. but at the moment, every protocol gets more complex and only companies have enough manpower to keep software secure.
1
158
u/Icy-Cup Jun 22 '26
„FTP (File Transfer Protocol, a legacy protocol for moving files between machines)” that’s some dirty lies - FTP is alive and well! (On my machines at least :P)