CVE-2016-4051: Buffer Overflow
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
Other sources
Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid.
External references:
http://www.squid-cache.org/Advisories/SQUID-20165.txt
Upstream fixes:
[RHEL-7] www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-20165.patch
[Fedora-23] http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-20165.patch
[Fedora-22] http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-20165.patch
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4051?
CVE-2016-4051 is classified as a high-severity vulnerability due to its potential to allow denial of service or arbitrary code execution.
How do I fix CVE-2016-4051?
To remediate CVE-2016-4051, upgrade to Squid versions 3.5.17 or later, or 4.0.9 or later.
Which versions of Squid are affected by CVE-2016-4051?
CVE-2016-4051 affects Squid versions 2.x, 3.x before 3.5.17, and 4.x before 4.0.9.
What kind of attacks can be executed using CVE-2016-4051?
Attackers can exploit CVE-2016-4051 to launch denial of service attacks or execute arbitrary code on vulnerable servers.
Is CVE-2016-4051 exploitable remotely?
Yes, CVE-2016-4051 can be exploited remotely by sending crafted data to the vulnerable cachemgr.cgi tool.