Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: buffer-over-read in SSPI and SMB authentication CVE-2022-41318 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

ALSA-2022:6775 Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: buffer-over-read in SSPI and SMB authentication CVE-2022-41318 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

MGASA-2022-0351 Updated squid packages fix security vulnerability

Exposure of Sensitive Information in Cache Manager. CVE-2022-41317 Buffer Over Read in SSPI and SMB Authentication. CVE-2022-41318...

Updated squid packages fix security vulnerability

Exposure of Sensitive Information in Cache Manager. CVE-2022-41317 Buffer Over Read in SSPI and SMB Authentication. CVE-2022-41318...

Squid Buffer Overflow Vulnerability (SQUID-2022:2)

Squid is prone to a buffer overflow vulnerability in SSPI and SMB authentication. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

Ubuntu: Security Advisory (USN-5641-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Buffer Overflow

squid is vulnerable to buffer overflow. The vulnerability exists due to a lack of sanitization of the input in SSPI and SMB Authentication allowing an attacker to corrupt the memory...

USN-5641-1: Squid vulnerabilities

Mikhail Evdokimov discovered that Squid incorrectly handled cache manager ACLs. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. CVE-2022-41317 It was discovered that Squid incorrectly handled SSPI an...

CVE-2022-41318

A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure. Mitigation Disable use of the vulnerable authentication scheme...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

PT-2022-1976 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the Microsoft Security Support Provider Interface SSPI in the Microsoft Windows operating system, which is associated with insecure privilege management. Exploitatio...

Arbitrary Code Execution

libcurl.so is vulnerable to arbitrary code execution. When built with SSPI or telnet is enabled, a local user is able to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse 1 security.dll, 2 secur32.dll, or 3 ws232.dll in the application or current working directory...

freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds OOB read vulnerability has been detected in ntlmreadChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlmmessage.c...

Taking Transport Layer Security (TLS) to the next level with TLS 1.3

Transport Layer Security TLS 1.3 is now enabled by default on Windows 10 Insider Preview builds, starting with Build 20170, the first step in a broader rollout to Windows 10 systems. TLS 1.3 is the latest version of the internet’s most deployed security protocol, which encrypts data to provide a...

Denial Of Service (DoS)

freerdp is vulnerable to Denial Of Service DoS. The vulnerability exists through an out-of-bounds OOB read vulnerability has been detected in ntlmreadChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlmmessage.c...

Server VDA suddenly goes to unregistered state with error: The Security Support Provider Interface (SSPI) negotiation failed.

Studio shows as unregistered. Ping works fine. VDA registration health check tool passes all the tests. Error: Exception System.ComponentModel.Win32Exception 0x80004005: The Security Support Provider Interface SSPI negotiation failed...

CVE-2020-13396

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds OOB read vulnerability has been detected in ntlmreadChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlmmessage.c...

Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation Exploit

Exploit for windows platform in category local exploits Windows: SSPI Network Authentication Session 0 EoP Platform: Windows 10 1803/1809 not tested earlier versions Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: Session boundary Summary: Performing an NTLM...

Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation

Windows: SSPI Network Authentication Session 0 EoP Platform: Windows 10 1803/1809 not tested earlier versions Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: Session boundary Summary: Performing an NTLM authentication to the same machine results in a network...

Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation

Microsoft Windows 10 - SSPI Network Authentication Session 0 Privilege Escalation Windows: SSPI Network Authentication Session 0 EoP Platform: Windows 10 1803/1809 not tested earlier versions Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: Session boundary...