CVE-2004-0541
Squid Web Proxy Cache 2.5.x and 3.x - Remote Code Execution via NTLM Authentication Password Overflow
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2004-0541.
PoCs published by Metasploit, skape, including Metasploit module exploits/linux/proxy/squid_ntlm_authenticate.
AI-analyzed exploit summary This is a Metasploit module exploiting a stack-based buffer overflow in Squid's NTLM authentication (CVE-2004-0541). It crafts malicious NTLMSSP_AUTHENTICATE messages to overwrite the return address and execute shellcode.
Description
Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable).
Exploits (3)
This is a Metasploit module exploiting a stack-based buffer overflow in Squid's NTLM authentication (CVE-2004-0541). It crafts malicious NTLMSSP_AUTHENTICATE messages to overwrite the return address and execute shellcode.
This is a Metasploit module exploiting a stack-based buffer overflow in Squid's NTLM authentication (CVE-2004-0541). It crafts malicious NTLMSSP_AUTHENTICATE packets to overflow the 'pass' variable, allowing arbitrary code execution.
This Metasploit module exploits a stack-based buffer overflow in Squid's NTLM authentication (CVE-2004-0541) by sending maliciously crafted NTLMSSP_AUTHENTICATE messages. It targets Linux systems with a brute-force approach to bypass ASLR.