CVE-2014-9749: Medium severity Squid-Cache Squid vulnerability
Published Nov 6, 2015
·Updated
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."
Affected Software
17 affected components
Squid-Cache Squid=3.4.4
Squid-Cache Squid=3.4.5
Squid-Cache Squid=3.4.6
Squid-Cache Squid=3.4.7
Squid-Cache Squid=3.4.8
Squid-Cache Squid=3.4.9
Squid-Cache Squid=3.4.10
Squid-Cache Squid=3.4.11
Squid-Cache Squid=3.4.12
Squid-Cache Squid=3.4.13
Squid-Cache Squid=3.5.0.1
Squid-Cache Squid=3.5.0.2
Squid-Cache Squid=3.5.0.3
Squid-Cache Squid=3.5.0.4
Squid-Cache Squid=3.5.1
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
Nov 6, 2015
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9749?
CVE-2014-9749 has a medium severity rating due to the potential for unauthorized access through nonce replay.
2
How do I fix CVE-2014-9749?
To fix CVE-2014-9749, upgrade to versions 3.4.12 or later, or 3.5.2 or later of Squid.
3
What type of attack does CVE-2014-9749 represent?
CVE-2014-9749 represents a nonce replay attack which allows authenticated users to reuse stale nonces, potentially leading to unauthorized access.
4
Which versions of Squid are affected by CVE-2014-9749?
CVE-2014-9749 affects Squid versions 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1.
5
Is CVE-2014-9749 exploitable remotely?
Yes, CVE-2014-9749 is exploitable remotely by authenticated users leveraging a stale nonce.