Friday Squid Blogging: Editing the Squid Genome

Scientists have edited the genome of the Doryteuthis pealeii squid with CRISPR. A first. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Oracle Linux 8 : squid:4 (ELSA-2020-2041)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2041 advisory. - Resolves: 1828368 - CVE-2019-12519 squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow - Resolves: 18283...

Buffer Overflows

Squid is vulnerable to buffer overflows. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy...

Information Disclosure

squid is vulnerable to information disclosure. Due to incorrect input validation, the application interprets malicious HTTP requests in unexpected ways to access server resources prohibited by earlier security filters...

Information Disclosure

Squid is vulnerable to information disclosure. An issue was discovered in Squid allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes...

Denial Of Service (DoS)

squid is vulnerable to denial of service. The vulnerability exists due to incorrect input validation, the NTLM authentication credentials parser in extlmgroupacl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process...

Ubuntu 16.04 LTS / 18.04 LTS : Squid vulnerabilities (USN-4446-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4446-1 advisory. Jeriko One discovered that Squid incorrectly handled caching certain requests. A remote attacker could possibly use this issue to perform...

USN-4446-1: Squid vulnerabilities

Jeriko One discovered that Squid incorrectly handled caching certain requests. A remote attacker could possibly use this issue to perform cache-injection attacks or gain access to reverse proxy features such as ESI. CVE-2019-12520 Jeriko One and Kristoffer Danielsson discovered that Squid...

Friday Squid Blogging: Squid Proteins for a Better Face Mask

Researchers are synthesizing squid proteins to create a face mask that better survives cleaning. And you thought there was no connection between squid and COVID-19. The military thinks this might have applications for self-healing robots. As usual, you can also use this squid post to talk about t...

Huawei EulerOS: Security Advisory for squid (EulerOS-SA-2020-1828)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1828)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This functi...

Sarg: Local privilege escalation

Background Sarg Squid Analysis Report Generator is a tool that provides many informations about the Squid web proxy server users activities: time, sites, traffic, etc. Description A flaw in Sarg’s handling of temporary directories was discovered. Impact A local attacker may be able to escalate...

Debian DSA-4732-1 : squid - security update

Two security issues were discovered in the Squid proxy caching server, which could result in cache poisoning, request smuggling and incomplete validation of hostnames in cachemgr.cgi. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debia...

Debian: Security Advisory (DSA-4732-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4732-1] squid security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4732-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 21, 2020 https://www.debian.org/security/faq -...

SUSE SLES12 Security Update : squid (SUSE-SU-2020:1946-1)

This update for squid fixes the following issues : CVE-2020-15049.patch: fixes a Cache Poisoning and Request Smuggling attack CVE-2020-15049, bsc1173455 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted...

openSUSE Security Update : squid (openSUSE-2020-910)

This update for squid fixes the following issues : squid was updated to version 4.12 Security issue fixed : - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed : - Reverted to slow search for new SM...

openSUSE Security Update : squid (openSUSE-2020-914)

This update for squid fixes the following issues : squid was updated to version 4.12 Security issue fixed : - CVE-2020-14059: Fixed an issue where a client could potentially deny the service of a server during TLS Handshake bsc1173304. Other issues addressed : - Reverted to slow search for new SM...

Amazon Linux AMI : squid (ALAS-2020-1386)

The version of squid installed on the remote host is prior to 3.5.20-15.39. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1386 advisory. An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gai...

Friday Squid Blogging: Squid Found on Provincetown Sandbar

Headline: "Dozens of squid found on Provincetown sandbar." Slow news day. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...