CVE-2014-0128: Input Validation

Published Apr 14, 2014

Updated

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Affected Software

87 affected components

Squid-Cache Squid=3.1

Squid-Cache Squid=3.1.0.1

Squid-Cache Squid=3.1.0.2

Squid-Cache Squid=3.1.0.3

Squid-Cache Squid=3.1.0.4

Squid-Cache Squid=3.1.0.5

Squid-Cache Squid=3.1.0.6

Squid-Cache Squid=3.1.0.7

Squid-Cache Squid=3.1.0.8

Squid-Cache Squid=3.1.0.9

Squid-Cache Squid=3.1.0.10

Squid-Cache Squid=3.1.0.11

Squid-Cache Squid=3.1.0.12

Squid-Cache Squid=3.1.0.13

Squid-Cache Squid=3.1.0.14

Squid-Cache Squid=3.1.0.15

Squid-Cache Squid=3.1.0.16

Squid-Cache Squid=3.1.0.17

Squid-Cache Squid=3.1.0.18

Squid-Cache Squid=3.1.1

Squid-Cache Squid=3.1.2

Squid-Cache Squid=3.1.3

Squid-Cache Squid=3.1.4

Squid-Cache Squid=3.1.5

Squid-Cache Squid=3.1.5.1

Squid-Cache Squid=3.1.6

Squid-Cache Squid=3.1.7

Squid-Cache Squid=3.1.8

Squid-Cache Squid=3.1.9

Squid-Cache Squid=3.1.10

Squid-Cache Squid=3.1.11

Squid-Cache Squid=3.1.12

Squid-Cache Squid=3.1.13

Squid-Cache Squid=3.1.14

Squid-Cache Squid=3.1.15

Squid-Cache Squid=3.2.0.1

Squid-Cache Squid=3.2.0.2

Squid-Cache Squid=3.2.0.3

Squid-Cache Squid=3.2.0.4

Squid-Cache Squid=3.2.0.5

Squid-Cache Squid=3.2.0.6

Squid-Cache Squid=3.2.0.7

Squid-Cache Squid=3.2.0.8

Squid-Cache Squid=3.2.0.9

Squid-Cache Squid=3.2.0.10

Squid-Cache Squid=3.2.0.11

Squid-Cache Squid=3.2.0.12

Squid-Cache Squid=3.2.0.13

Squid-Cache Squid=3.2.0.14

Squid-Cache Squid=3.2.0.15

Squid-Cache Squid=3.2.0.16

Squid-Cache Squid=3.2.0.17

Squid-Cache Squid=3.2.0.18

Squid-Cache Squid=3.2.0.19

Squid-Cache Squid=3.2.1

Squid-Cache Squid=3.2.2

Squid-Cache Squid=3.2.3

Squid-Cache Squid=3.2.4

Squid-Cache Squid=3.2.5

Squid-Cache Squid=3.2.6

Squid-Cache Squid=3.2.7

Squid-Cache Squid=3.2.8

Squid-Cache Squid=3.2.9

Squid-Cache Squid=3.2.10

Squid-Cache Squid=3.2.11

Squid-Cache Squid=3.2.12

Squid-Cache Squid=3.3.0

Squid-Cache Squid=3.3.0.2

Squid-Cache Squid=3.3.0.3

Squid-Cache Squid=3.3.1

Squid-Cache Squid=3.3.2

Squid-Cache Squid=3.3.3

Squid-Cache Squid=3.3.4

Squid-Cache Squid=3.3.5

Squid-Cache Squid=3.3.6

Squid-Cache Squid=3.3.7

Squid-Cache Squid=3.3.8

Squid-Cache Squid=3.3.9

Squid-Cache Squid=3.3.10

Squid-Cache Squid=3.3.11

Squid-Cache Squid=3.4.0.1

Squid-Cache Squid=3.4.0.2

Squid-Cache Squid=3.4.0.3

Squid-Cache Squid=3.4.1

Squid-Cache Squid=3.4.2

Squid-Cache Squid=3.4.3

openSUSE openSUSE=11.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 3.3.12
Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 3.4.4

Event History

Apr 14, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:09 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0128?

CVE-2014-0128 is classified as a denial of service vulnerability.

How do I fix CVE-2014-0128?

To remediate CVE-2014-0128, upgrade to Squid versions 3.3.12 or 3.4.4 and above.

Which versions of Squid are affected by CVE-2014-0128?

CVE-2014-0128 affects Squid versions before 3.3.12 and 3.4 before 3.4.4.

What impact does CVE-2014-0128 have on affected systems?

The vulnerability can cause a denial of service through assertion failures due to crafted range requests.

Is SSL-Bump a factor in CVE-2014-0128?

Yes, CVE-2014-0128 is specifically an issue when SSL-Bump is enabled in Squid.