Lucene search

K
archlinuxArchLinuxASA-201911-8
HistoryNov 07, 2019 - 12:00 a.m.

[ASA-201911-8] squid: multiple issues

2019-11-0700:00:00
security.archlinux.org
13

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.185 Low

EPSS

Percentile

96.1%

Arch Linux Security Advisory ASA-201911-8

Severity: Critical
Date : 2019-11-07
CVE-ID : CVE-2019-12526 CVE-2019-18678 CVE-2019-18679
Package : squid
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1062

Summary

The package squid before version 4.9-1 is vulnerable to multiple issues
including arbitrary code execution, content spoofing and information
disclosure.

Resolution

Upgrade to 4.9-1.

pacman -Syu “squid>=4.9-1”

The problems have been fixed upstream in version 4.9.

Workaround

  • CVE-2019-12526

Deny urn: protocol URI being proxied to all clients:

acl URN proto URN
http_access deny URN
  • CVE-2019-18678

There are no workarounds for this vulnerability.

  • CVE-2019-18679

Digest authentication can be disabled by removing all ‘auth_param
digest …’ configuration settings from squid.conf.

Description

  • CVE-2019-12526 (arbitrary code execution)

A heap-based buffer overflow has been found in Squid before 4.9, when
processing URN.

  • CVE-2019-18678 (content spoofing)

A HTTP request splitting issue has been found in Squid before 4.9. This
issue allows attackers to smuggle HTTP requests through frontend
software to a Squid which splits the HTTP Request pipeline differently.
The resulting Response messages corrupt caches between client and Squid
with attacker controlled content at arbitrary URLs.

  • CVE-2019-18679 (information disclosure)

An information disclosure issue has been found in Squid before 4.9,
when processing HTTP Digest Authentication. The nonce tokens contain
the raw byte value of a pointer which sits within heap memory
allocation, which reduces ASLR protections and may aid attackers
isolating memory areas to target for remote code execution attacks.

Impact

A remote attacker might access sensitive information, corrupt the
content of arbitrary URLs in the caches or execute arbitrary code.

References

http://www.squid-cache.org/Advisories/SQUID-2019_7.txt
http://www.squid-cache.org/Advisories/SQUID-2019_10.txt
http://www.squid-cache.org/Advisories/SQUID-2019_11.txt
http://www.squid-cache.org/Versions/v4/changesets/squid-4-7aa0184a720fd216191474e079f4fe87de7c4f5a.patch
http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch
http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patc
https://security.archlinux.org/CVE-2019-12526
https://security.archlinux.org/CVE-2019-18678
https://security.archlinux.org/CVE-2019-18679

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanysquid< 4.9-1UNKNOWN

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.185 Low

EPSS

Percentile

96.1%