Lucene search

K
archlinuxArchLinuxASA-202105-10
HistoryMay 19, 2021 - 12:00 a.m.

[ASA-202105-10] squid: denial of service

2021-05-1900:00:00
security.archlinux.org
184

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

Arch Linux Security Advisory ASA-202105-10

Severity: High
Date : 2021-05-19
CVE-ID : CVE-2021-28651 CVE-2021-28652 CVE-2021-28662
Package : squid
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1949

Summary

The package squid before version 4.15-1 is vulnerable to denial of
service.

Resolution

Upgrade to 4.15-1.

pacman -Syu “squid>=4.15-1”

The problems have been fixed upstream in version 4.15.

Workaround

  • CVE-2021-28651 can be mitigated by disabling URN processing by the
    proxy, by adding these lines to squid.conf:

acl URN proto URN
http_access deny URN

  • CVE-2021-28652 can be mitigated by either disabling Cache Manager
    access entirely if not needed, by placing the following line in
    squid.conf before lines containing “allow”:

http_access deny manager

or by hardening Cache Manager access privileges, for example: require
authentication or other access controls in http_access beyond the
default IP address restriction.

  • No known mitigations exist for CVE-2021-28662.

Description

  • CVE-2021-28651 (denial of service)

Due to a buffer management bug Squid before version 4.15 is vulnerable
to a denial of service attack against the server it is operating on.
This attack is limited to proxies which attempt to resolve a “urn:”
resource identifier. Support for this resolving is enabled by default
in all Squid.

  • CVE-2021-28652 (denial of service)

Due to an incorrect parser validation bug Squid before version 4.15 is
vulnerable to a denial of Service attack against the Cache Manager API.

  • CVE-2021-28662 (denial of service)

Due to an input validation bug Squid before version 4.15 is vulnerable
to a denial of service against all clients using the proxy.

Impact

A remote attacker can cause denial of service through crafted requests.

References

https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4
http://www.squid-cache.org/Versions/v4/changesets/squid-4-a975fd5aedc866629214aaaccb38376855351899.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447
http://www.squid-cache.org/Versions/v4/changesets/squid-4-0003e3518dc95e4b5ab46b5140af79b22253048e.patch
https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h
http://www.squid-cache.org/Versions/v4/changesets/squid-4-b1c37c9e7b30d0efb5e5ccf8200f2a646b9c36f8.patch
https://security.archlinux.org/CVE-2021-28651
https://security.archlinux.org/CVE-2021-28652
https://security.archlinux.org/CVE-2021-28662

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanysquid< 4.15-1UNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

Related for ASA-202105-10