GHSA-w4gv-vw3f-29g3: Squid's URN Handling can lead to Buffer Overflow
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 6.4 - Configuration
Disable URN access permissions as a workaround.
Squid URN access permissions = disabled
Event History
Frequently Asked Questions
Which deployments are affected?
Squid versions 6.3 and below are affected. The issue occurs when Squid processes URN requests, so deployments that permit URN access are exposed.
What does an attacker need to exploit this issue?
An attacker can trigger the flaw remotely by sending a request that causes Squid to process a URN. No authentication or user interaction is required according to the supplied attack vector.
What should be done if upgrading is not immediately possible?
Disable URN access permissions to work around the vulnerability. Upgrading to Squid 6.4 fixes the underlying buffer-management issue.