CVE-2009-0801: Medium severity Squid Squid Web Proxy Cache vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0801 to the following vulnerability:
Name: CVE-2009-0801 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0801 Assigned: 20090304 Reference: CERT-VN:VU#435052 Reference: URL: http://www.kb.cert.org/vuls/id/435052 Reference: BID:33858 Reference: URL: http://www.securityfocus.com/bid/33858
Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
Other sources
It was found that when transparent interception mode was enabled in squid a remote attacker could bypass access controls implemented for certain web elements like Flash and Java and communicate with restricted intranet sites via crafted Host headers.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 3.2.0.11 - Configuration
Disable transparent interception mode in Squid to prevent Squid from using the HTTP Host header to determine the remote endpoint, which can be abused to bypass access controls (e.g., Flash, Java, Silverlight) via crafted Host headers.
Squid Web Proxy Cache (redhat/squid) transparent interception mode = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0801?
CVE-2009-0801 is classified as a medium severity vulnerability.
How do I fix CVE-2009-0801?
To fix CVE-2009-0801, upgrade to Squid versions 3.2.0.11 or higher.
What versions of Squid are affected by CVE-2009-0801?
CVE-2009-0801 affects Squid versions 2.7.stable5, 2.7.stable6, 3.0_stable1 through 3.0_stable13, and earlier versions.
What type of attack does CVE-2009-0801 allow?
CVE-2009-0801 allows remote attackers to bypass access controls and potentially access restricted resources.
Is transparent interception mode related to CVE-2009-0801?
Yes, CVE-2009-0801 occurs when Squid is configured in transparent interception mode.