Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses.
Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses.
Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses.
External references:
http://www.squid-cache.org/Advisories/SQUID-20166.txt
Upstream fix:
[RHEL-7] http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12697.patch
[Fedora-22] http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13235.patch
[Fedora-23] http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14034.patch
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
clientsiderequest.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
A flaw was reported [1] in how Squid parsed responses from Gopher servers. This flaw could result in a buffer overflow if a Gopher server were to return a line longer than 4096 bytes, leading to memory corruption and a crash. This flaw is an extension of SQUID-2005:1 (or CVE-2005-0094) in Squid 3.x, due to increased packet read sizes. A malicious user could setup a fake Gopher server and forward requests to it through Squid. A specially crafted response from that server could cause Squid to restart.
This has been corrected in upstream versions 3.2.0.11, 3.1.15, and 3.0.STABLE26. Patches for 3.0 [2], 3.1 [3], and 3.2 [4] are available.
[1] http://www.squid-cache.org/Advisories/SQUID-20113.txt [2] http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch [3] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch [4] http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch
Last updated 24 July 2024
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.
A denial of service flaw was found in the way the CGI Cache Manager of the Squid proxy caching server processed certain requests. A remote attacker could this this flaw to cause the squid service to consume excessive amount of resources.
References: [1] http://www.squid-cache.org/Advisories/SQUID-20121.txt [2] https://bugs.gentoo.org/showbug.cgi?id=447596 [3] https://secunia.com/advisories/51545/
Upstream patches: [4] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch (against the 3.1 branch) [5] http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch (against the 3.2 branch)
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."
The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.