Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
Due to incorrect input validation Squid is vulnerable to a header smuggling attack leading to cache poisoning and to bypass of same-origin security policy in Squid and some client browsers.
External references:
http://www.squid-cache.org/Advisories/SQUID-20168.txt
Upstream fixes:
[RHEL-7]:
http://www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-20168.patch>
[RHEL-6]:
http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-20168.patch
[Fedora-22]:
http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-20168.patch
[Fedora-23]:
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-20168.patch
clientside.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.
Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses.
Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses.
Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses.
External references:
http://www.squid-cache.org/Advisories/SQUID-20166.txt
Upstream fix:
[RHEL-7] http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12697.patch
[Fedora-22] http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13235.patch
[Fedora-23] http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14034.patch
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.
Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
clientsiderequest.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
A flaw was reported [1] in how Squid parsed responses from Gopher servers. This flaw could result in a buffer overflow if a Gopher server were to return a line longer than 4096 bytes, leading to memory corruption and a crash. This flaw is an extension of SQUID-2005:1 (or CVE-2005-0094) in Squid 3.x, due to increased packet read sizes. A malicious user could setup a fake Gopher server and forward requests to it through Squid. A specially crafted response from that server could cause Squid to restart.
This has been corrected in upstream versions 3.2.0.11, 3.1.15, and 3.0.STABLE26. Patches for 3.0 [2], 3.1 [3], and 3.2 [4] are available.
[1] http://www.squid-cache.org/Advisories/SQUID-20113.txt [2] http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch [3] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch [4] http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch
Last updated 24 July 2024
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cachepeer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.
An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list.
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
DISPUTED Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "reqheader Host" acl regex that matches www.uol.com.br.
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.
A denial of service flaw was found in the way the CGI Cache Manager of the Squid proxy caching server processed certain requests. A remote attacker could this this flaw to cause the squid service to consume excessive amount of resources.
References: [1] http://www.squid-cache.org/Advisories/SQUID-20121.txt [2] https://bugs.gentoo.org/showbug.cgi?id=447596 [3] https://secunia.com/advisories/51545/
Upstream patches: [4] http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch (against the 3.1 branch) [5] http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch (against the 3.2 branch)
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) clientside.cc.
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.
clientsiderequest.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header.
A denial of service flaw was found in the way Squid used to process certain external ACL helper HTTP-Header fields (%{header:<delimiter>member}), where <delimiter> is not a comma. Remote attacker could use this flaw to cause an excessive CPU use by issuing such a request to the Squid server.
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2855 to this vulnerability: ------------------------------------------------------------------------------
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
References: ----------- [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2855 [2] http://www.openwall.com/lists/oss-security/2009/07/20/10 [3] http://www.openwall.com/lists/oss-security/2009/08/03/3 [4] http://www.openwall.com/lists/oss-security/2009/08/04/6 [5] http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=31;filename=diff;att=1;bug=534982 [6] http://www.squid-cache.org/bugs/showbug.cgi?id=2704 [7] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982
Note: The proposed patch from Debian [6] isn't the upstream one. Please wait, while upstream confirms it or comes with another one.
Upstream bug report: --------------------
http://www.squid-cache.org/bugs/showbug.cgi?id=2541
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."
The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.
CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.