Some reference updates.
On 11/10/23 20:55, Joshua Rogers wrote: The issues are listed below. Due to the sheer size of issues discovered, technical details are not included in this email. However, breakdowns of the code and proof-of-concepts can be found on GitHub: https://megamansec.github.io/Squid-Security-Audit/
Cache Poisoning by Large Stored Response Headers (With Bonus XSS) ... GHSA-543m-w2m2-g255 Gopher Assertion Crash ... GHSA-f5cp-6rh3-284w Assertion in Gopher Response Handling ... CVE-2021-46784 / GHSA-f5cp-6rh3-284w
AYJ
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list.
A vulnerability was found in cachemgr.cgi web module of Squid through 4.7 has XSS via the username or auth parameter.
Reference: https://bugs.squid-cache.org/showbug.cgi?id=4957 https://github.com/squid-cache/squid/pull/429
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
Due to incorrect reference counting Squid is vulnerable to a denial of service attack when processing ESI responses.
External references:
http://www.squid-cache.org/Advisories/SQUID-20169.txt
Upstream fixes:
Squid 3.5:
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-20169.patch
Squid 3.4:
http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-20169.patch
NOTE: For the other related CVE, CVE-2016-4555, see Bug 1334246
clientsiderequest.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
Due to incorrect input validation Squid is vulnerable to a header smuggling attack leading to cache poisoning and to bypass of same-origin security policy in Squid and some client browsers.
External references:
http://www.squid-cache.org/Advisories/SQUID-20168.txt
Upstream fixes:
[RHEL-7]:
http://www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-20168.patch>
[RHEL-6]:
http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-20168.patch
[Fedora-22]:
http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-20168.patch
[Fedora-23]:
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-20168.patch
clientside.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses.
Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses.
Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses.
External references:
http://www.squid-cache.org/Advisories/SQUID-20166.txt
Upstream fix:
[RHEL-7] http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12697.patch
[Fedora-22] http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13235.patch
[Fedora-23] http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14034.patch
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cachepeer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.
CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
End of life: 8/7/2018, Latest version: 3.5.28
End of life: 8/7/2018, Latest version: 3.5.28
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."
Last updated 24 July 2024
Sebastian Krahmer discovered an off-by-one error, leading to a heap-based buffer overflow flaw, in the way Squid handled UDP SNMP requests. An unauthenticated, remote attacker could possibly use this flaw to crash Squid or, potentially, execute arbitrary code.
As noted in Sebastian's original report, an SNMP port must be configured. The default configuration of Squid for Red Hat Enterprise Linux 6 and 7 does not include an snmpport declaration (http://wiki.squid-cache.org/Features/Snmp).
Patch:
http://bugzillafiles.novell.org/attachment.cgi?id=605545
References:
https://bugzilla.novell.com/showbug.cgi?id=895773 http://seclists.org/oss-sec/2014/q3/542
End of life: 8/1/2015, Latest version: 3.4.14
End of life: 8/1/2015, Latest version: 3.4.14
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.