[squid-users] Re: Squid Security Update Advisory 2002:3

Correct.

"httpd_accel_with_proxy off" in combination with "httpd_accel_host ..."
effectively denies any attempts for proxying ftp:// or gopher:// URL's.

You may still be vulnerable if you are using a redirector to rewrite the
received HTTP requests into ftp:// or gopher:// URLs to servers you do
not trust fully... but I guess you are not doing anything like this.

Regards
Henrik

Another user wrote:
>
> On Wed, 3 Jul 2002, Henrik Nordstrom wrote:
>
> > - Several bugfixes and cleanup of the Gopher client,
> > - Security fixes in how Squid parses FTP directory listings into
> ...
>
> Is it true that with "httpd_accel_with_proxy off" these issues do not
> affect Squid? I'm running a few Squids as HTTP accelerators and I wonder
> how many days I can delay the upgrade...
Received on Thu Jul 04 2002 - 05:13:33 MDT