CVE-2016-10002: Infoleak
Published Jan 27, 2017
·Updated
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
Affected Software
122 affected components
Debian Debian Linux=8.0
Squid-Cache Squid=3.1.10
Squid-Cache Squid=3.1.11
Squid-Cache Squid=3.1.12
Squid-Cache Squid=3.1.14
Squid-Cache Squid=3.1.15
Squid-Cache Squid=3.1.16
Squid-Cache Squid=3.1.17
Squid-Cache Squid=3.1.18
Squid-Cache Squid=3.1.19
Squid-Cache Squid=3.1.20
Squid-Cache Squid=3.1.21
Squid-Cache Squid=3.1.22
Squid-Cache Squid=3.1.23
Squid-Cache Squid=3.2.0.3
Squid-Cache Squid=3.2.0.4
Squid-Cache Squid=3.2.0.5
Squid-Cache Squid=3.2.0.6
Squid-Cache Squid=3.2.0.7
Squid-Cache Squid=3.2.0.8
Squid-Cache Squid=3.2.0.9
Squid-Cache Squid=3.2.0.10
Squid-Cache Squid=3.2.0.11
Squid-Cache Squid=3.2.0.12
Squid-Cache Squid=3.2.0.13
Squid-Cache Squid=3.2.0.14
Squid-Cache Squid=3.2.0.15
Squid-Cache Squid=3.2.0.16
Squid-Cache Squid=3.2.0.17
Squid-Cache Squid=3.2.0.18
Squid-Cache Squid=3.2.0.19
Squid-Cache Squid=3.2.1
Squid-Cache Squid=3.2.2
Squid-Cache Squid=3.2.3
Squid-Cache Squid=3.2.4
Squid-Cache Squid=3.2.5
Squid-Cache Squid=3.2.6
Squid-Cache Squid=3.2.7
Squid-Cache Squid=3.2.8
Squid-Cache Squid=3.2.9
Squid-Cache Squid=3.2.10
Squid-Cache Squid=3.2.11
Squid-Cache Squid=3.2.12
Squid-Cache Squid=3.2.13
Squid-Cache Squid=3.2.14
Squid-Cache Squid=3.3.0.1
Squid-Cache Squid=3.3.0.2
Squid-Cache Squid=3.3.0.3
Squid-Cache Squid=3.3.1
Squid-Cache Squid=3.3.2
Squid-Cache Squid=3.3.3
Squid-Cache Squid=3.3.4
Squid-Cache Squid=3.3.5
Squid-Cache Squid=3.3.6
Squid-Cache Squid=3.3.7
Squid-Cache Squid=3.3.8
Squid-Cache Squid=3.3.9
Squid-Cache Squid=3.3.10
Squid-Cache Squid=3.3.11
Squid-Cache Squid=3.3.12
Squid-Cache Squid=3.3.13
Squid-Cache Squid=3.3.14
Squid-Cache Squid=3.4.0.1
Squid-Cache Squid=3.4.0.2
Squid-Cache Squid=3.4.0.3
Squid-Cache Squid=3.4.0.4
Squid-Cache Squid=3.4.1
Squid-Cache Squid=3.4.2
Squid-Cache Squid=3.4.3
Squid-Cache Squid=3.4.4
Squid-Cache Squid=3.4.5
Squid-Cache Squid=3.4.6
Squid-Cache Squid=3.4.7
Squid-Cache Squid=3.4.8
Squid-Cache Squid=3.4.9
Squid-Cache Squid=3.4.10
Squid-Cache Squid=3.4.11
Squid-Cache Squid=3.4.12
Squid-Cache Squid=3.4.13
Squid-Cache Squid=3.4.14
Squid-Cache Squid=3.5.0.1
Squid-Cache Squid=3.5.0.2
Squid-Cache Squid=3.5.0.3
Squid-Cache Squid=3.5.0.4
Squid-Cache Squid=3.5.1
Squid-Cache Squid=3.5.2
Squid-Cache Squid=3.5.3
Squid-Cache Squid=3.5.4
Squid-Cache Squid=3.5.5
Squid-Cache Squid=3.5.6
Squid-Cache Squid=3.5.7
Squid-Cache Squid=3.5.8
Squid-Cache Squid=3.5.9
Squid-Cache Squid=3.5.10
Squid-Cache Squid=3.5.11
Squid-Cache Squid=3.5.12
Squid-Cache Squid=3.5.13
Squid-Cache Squid=3.5.14
Squid-Cache Squid=3.5.15
Squid-Cache Squid=3.5.16
Squid-Cache Squid=3.5.17
Squid-Cache Squid=3.5.18
Squid-Cache Squid=3.5.19
Squid-Cache Squid=3.5.20
Squid-Cache Squid=3.5.21
Squid-Cache Squid=3.5.22
Squid-Cache Squid=4.0.1
Squid-Cache Squid=4.0.2
Squid-Cache Squid=4.0.3
Squid-Cache Squid=4.0.4
Squid-Cache Squid=4.0.5
Squid-Cache Squid=4.0.6
Squid-Cache Squid=4.0.7
Squid-Cache Squid=4.0.8
Squid-Cache Squid=4.0.9
Squid-Cache Squid=4.0.10
Squid-Cache Squid=4.0.11
Squid-Cache Squid=4.0.12
Squid-Cache Squid=4.0.13
Squid-Cache Squid=4.0.14
Squid-Cache Squid=4.0.15
Squid-Cache Squid=4.0.16
Remediation
Patch Available
Patch Available
Event History
Jan 27, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-10002?
CVE-2016-10002 has a medium severity level due to the risk of client-specific cookie data leakage.
2
How do I fix CVE-2016-10002?
To fix CVE-2016-10002, upgrade to the patched versions of Squid HTTP Proxy 3.5.23 or later.
3
Which versions of Squid are affected by CVE-2016-10002?
CVE-2016-10002 affects Squid HTTP Proxy versions 3.1.10 through 3.1.23, 3.2.0.3 to 3.5.22, and 4.0.1 to 4.0.16.
4
Is CVE-2016-10002 exploitable remotely?
Yes, CVE-2016-10002 can be exploited remotely by attackers crafting specific HTTP requests.
5
What kind of data is exposed due to CVE-2016-10002?
CVE-2016-10002 may lead to exposure of client-specific Cookie data to other clients.