Security<\/p>\n
Plus more blasts from the past: NetWare, FTP, and HTTP<\/p>\n
Sometimes it takes a while to detect a vuln. A 29-year-old, Heartbleed-style vulnerability<\/a> in Squid, a popular open-source caching proxy server, silently leaked users’ plaintext HTTP requests and potentially revealed sensitive data, including credentials and session tokens, for decades – until AI (and a few humans) saved the day.<\/p>\n A security researcher and Mythos Preview found the flaw and reported it to project maintainers, who fixed the code earlier this month.<\/p>\n Squid is widely used by large corporations, schools, and internet service providers to cache, filter, and monitor network traffic, and Calif.io researcher Lam Jun Rong said he came across the open source proxy while attempting to connect to the internet on a flight.<\/p>\n \u201cAs you might expect, the version of Squid deployed on that plane was released nearly 10 years ago and is affected by the vulnerability I’m about to share with you,\u201d Rong wrote<\/a> in a blog post about the bug, which he dubbed Squidbleed and investigated with help from Anthropic’s Claude Mythos Preview.<\/p>\n Rong reported the bug, tracked as CVE-2026-47729, to Squid\u2019s maintainers back in April, and it\u2019s fixed in Squid v7.6<\/a>, released June 8.<\/p>\n The Reg readers may remember Calif from their earlier HTTP\/2 Bomb research<\/a>, uncovered by OpenAI\u2019s Codex agent, and the AI bug-finding firm also collaborated with OpenAI on its Patch the Planet initiative<\/a>, announced on Monday.<\/p>\n According to Rong, Squidbleed leaks internal memory from every version of Squid in its default configuration with two conditions. First, Squid has to be able to read and inspect the network traffic, so it must be handling cleartext HTTP (not HTTPS) or be deployed in TLS-terminating setups.<\/p>\n Additionally, the proxy must be allowed to reach an attacker-controlled FTP (File Transfer Protocol) server via TCP port 21. FTP is an outdated protocol for moving files between machines, and Squid supports it – which is where the problem lies.<\/p>\n The bug exists in Squid’s FTP directory listing parser, and it was injected into the open source code as a commit (bb97dd37a<\/a>) created in 1997 to support old NetWare servers.<\/p>\n NetWare is a discontinued network operating system that was popular in the 1980s and 1990s, providing file and print services across local area networks before Windows and Linux servers became dominant. NetWare FTP servers also added extra whitespace between the modification timestamp and the filename, compared to most other FTP servers that just used a single spFace.<\/p>\n The 1997 commit fixed this NetWare issue by instructing the code to skip the extra whitespace using this loop: while (strchr(w_space, *copyFrom)) ++copyFrom;.<\/p>\n As Mythos Preview discovered, if an attacker’s FTP server doesn’t provide a filename after the modification timestamp, copyFrom points to the terminating NUL character at the end of the string. <\/p>\n \u201cstrchr treats that terminating NUL as part of the string it searches, so it returns a pointer instead of NULL, and the loop never stops,\u201d Rong explains. \u201cIt walks off the end of the buffer, and xstrdup copies whatever follows back to the attacker as a filename.\u201d<\/p>\n This results in a heap overread and can leak HTTP requests that often contain passwords or API keys, and Rong demonstrated this exploit in a proof of concept<\/a>.\u00a0<\/p>\n