{"id": "SECURITYVULNS:DOC:15049", "bulletinFamily": "software", "title": "[SA22824] PowerDNS Recursor Two Vulnerabilities", "description": "\r\nTITLE:\r\nPowerDNS Recursor Two Vulnerabilities\r\n\r\nSECUNIA ADVISORY ID:\r\nSA22824\r\n\r\nVERIFY ADVISORY:\r\nhttp://secunia.com/advisories/22824/\r\n\r\nCRITICAL:\r\nHighly critical\r\n\r\nIMPACT:\r\nDoS, System access\r\n\r\nWHERE:\r\n>From remote\r\n\r\nSOFTWARE:\r\nPowerDNS Recursor 3.x\r\nhttp://secunia.com/product/9556/\r\nPowerDNS 2.x\r\nhttp://secunia.com/product/929/\r\n\r\nDESCRIPTION:\r\nTwo vulnerabilities have been reported in PowerDNS Recursor, which\r\ncan be exploited by malicious people to cause a DoS (Denial of\r\nService) and potentially compromise a vulnerable system.\r\n\r\n1) An error in length calculation when handling TCP DNS queries can\r\nbe exploited to cause an overly large copy via a specially crafted\r\npacket.\r\n\r\nSuccessful exploitation may allow execution of arbitrary code.\r\n\r\n2) An error in the handling CNAME records can be exploited to crash\r\nthe service.\r\n\r\nThe vulnerabilities are reported in PowerDNS Recursor versions 3.1.3\r\nand prior. PowerDNS Authoritative Server (pdns_server) is not\r\naffected.\r\n\r\nSOLUTION:\r\nUpdate to PowerDNS Recursor 3.1.4.\r\n\r\nPROVIDED AND/OR DISCOVERED BY:\r\nReported by the vendor.\r\n\r\nORIGINAL ADVISORY:\r\nhttp://doc.powerdns.com/powerdns-advisory-2006-01.html\r\nhttp://doc.powerdns.com/powerdns-advisory-2006-02.html\r\n\r\n----------------------------------------------------------------------\r\n\r\nAbout:\r\nThis Advisory was delivered by Secunia as a free service to help\r\neverybody keeping their systems up to date against the latest\r\nvulnerabilities.\r\n\r\nSubscribe:\r\nhttp://secunia.com/secunia_security_advisories/\r\n\r\nDefinitions: (Criticality, Where etc.)\r\nhttp://secunia.com/about_secunia_advisories/\r\n\r\n\r\nPlease Note:\r\nSecunia recommends that you verify all advisories you receive by\r\nclicking the link.\r\nSecunia NEVER sends attached files with advisories.\r\nSecunia does not advise people to install third party patches, only\r\nuse those supplied by the vendor.\r\n", "published": "2006-11-14T00:00:00", "modified": "2006-11-14T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:15049", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:20", "edition": 1, "viewCount": 1, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-08-31T11:10:20", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2019-15049", "CVE-2014-2595", "CVE-2017-15049", "CVE-2015-9286", "CVE-2008-7273", "CVE-2008-7272"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:EBAE6A59FE76CD90573EFF9EC3FCEFCF"]}, {"type": "exploitdb", "idList": ["EDB-ID:43354"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:145453"]}, {"type": "zdt", "idList": ["1337DAY-ID-29243"]}, {"type": "openbugbounty", "idList": ["OBB:276123"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:32652", "SECURITYVULNS:DOC:32654", "SECURITYVULNS:DOC:32653", "SECURITYVULNS:VULN:14755", "SECURITYVULNS:VULN:14753", "SECURITYVULNS:DOC:32651", "SECURITYVULNS:VULN:14720", "SECURITYVULNS:DOC:32660", "SECURITYVULNS:DOC:32658"]}], "modified": "2018-08-31T11:10:20", "rev": 2}, "vulnersScore": 7.5}, "affectedSoftware": []}

{"nessus": [{"lastseen": "2021-02-25T17:09:36", "description": "According to the versions of the squid packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the browser cache and any\n downstream caches with content from an arbitrary\n source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding.\n This allows an attacker to hide a second request inside\n Transfer-Encoding: it is interpreted by Squid as\n chunked and split out into a second request delivered\n upstream. Squid will then deliver two distinct\n responses to the client, corrupting any downstream\n caches.(CVE-2020-15811)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 8.8, "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-02-22T00:00:00", "title": "EulerOS 2.0 SP2 : squid (EulerOS-SA-2021-1363)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15811", "CVE-2020-15810", "CVE-2020-15049"], "modified": "2021-02-22T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:squid", "cpe:/o:huawei:euleros:2.0", "p-cpe:/a:huawei:euleros:squid-migration-script"], "id": "EULEROS_SA-2021-1363.NASL", "href": "https://www.tenable.com/plugins/nessus/146721", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146721);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/02/24\");\n\n script_cve_id(\n \"CVE-2020-15049\",\n \"CVE-2020-15810\",\n \"CVE-2020-15811\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : squid (EulerOS-SA-2021-1363)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the squid packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the browser cache and any\n downstream caches with content from an arbitrary\n source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding.\n This allows an attacker to hide a second request inside\n Transfer-Encoding: it is interpreted by Squid as\n chunked and split out into a second request delivered\n upstream. Squid will then deliver two distinct\n responses to the client, corrupting any downstream\n caches.(CVE-2020-15811)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1363\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?27593c13\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"squid-3.5.20-2.2.h10\",\n \"squid-migration-script-3.5.20-2.2.h10\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2021-02-04T09:23:26", "description": "The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour\n (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 2, "cvss3": {"score": 7.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "published": "2021-02-01T00:00:00", "title": "CentOS 8 : squid:4 (CESA-2020:4743)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12529", "CVE-2019-12528", "CVE-2019-18677", "CVE-2019-12523", "CVE-2020-24606", "CVE-2019-18678", "CVE-2019-12524", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-18676", "CVE-2019-18860", "CVE-2020-8450", "CVE-2020-15049", "CVE-2019-12854", "CVE-2020-14058", "CVE-2019-12526", "CVE-2019-18679", "CVE-2020-8449"], "modified": "2021-02-01T00:00:00", "cpe": ["p-cpe:/a:centos:centos:squid", "p-cpe:/a:centos:centos:libecap-devel", "p-cpe:/a:centos:centos:libecap", "cpe:/o:centos:centos:8", "cpe:/a:centos:centos:8::appstream"], "id": "CENTOS8_RHSA-2020-4743.NASL", "href": "https://www.tenable.com/plugins/nessus/145969", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2020:4743. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145969);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/02/03\");\n\n script_cve_id(\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-12854\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-14058\",\n \"CVE-2020-15049\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4743\");\n\n script_name(english:\"CentOS 8 : squid:4 (CESA-2020:4743)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour\n (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4743\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libecap, libecap-devel and / or squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:centos:centos:8::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libecap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libecap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squid\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif ('CentOS Stream' >< release) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS Stream ' + os_ver);\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\nmodule_ver = get_kb_item('Host/RedHat/appstream/squid');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\nif ('4' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module squid:' + module_ver);\n\nappstreams = {\n 'squid:4': [\n {'reference':'libecap-1.0.1-2.module_el8.1.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-1.0.1-2.module_el8.1.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module_el8.1.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libecap-devel-1.0.1-2.module_el8.1.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'squid-4.11-3.module_el8.3.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'},\n {'reference':'squid-4.11-3.module_el8.3.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7'}\n ]\n};\n\nflag = 0;\nappstreams_found = 0;\nforeach module (keys(appstreams)) {\n appstream = NULL;\n appstream_name = NULL;\n appstream_version = NULL;\n appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach package_array ( appstreams[module] ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecap / libecap-devel / squid');\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-23T09:07:01", "description": "According to the versions of the squid packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the browser cache and any\n downstream caches with content from an arbitrary\n source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding.\n This allows an attacker to hide a second request inside\n Transfer-Encoding: it is interpreted by Squid as\n chunked and split out into a second request delivered\n upstream. Squid will then deliver two distinct\n responses to the client, corrupting any downstream\n caches.(CVE-2020-15811)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 8.8, "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-01-20T00:00:00", "title": "EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1123)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15811", "CVE-2020-15810", "CVE-2020-15049"], "modified": "2021-01-20T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:squid", "cpe:/o:huawei:euleros:2.0", "p-cpe:/a:huawei:euleros:squid-migration-script"], "id": "EULEROS_SA-2021-1123.NASL", "href": "https://www.tenable.com/plugins/nessus/145109", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145109);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/22\");\n\n script_cve_id(\n \"CVE-2020-15049\",\n \"CVE-2020-15810\",\n \"CVE-2020-15811\"\n );\n\n script_name(english:\"EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1123)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the squid packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the browser cache and any\n downstream caches with content from an arbitrary\n source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding.\n This allows an attacker to hide a second request inside\n Transfer-Encoding: it is interpreted by Squid as\n chunked and split out into a second request delivered\n upstream. Squid will then deliver two distinct\n responses to the client, corrupting any downstream\n caches.(CVE-2020-15811)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1123\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e19be93c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"squid-3.5.20-2.2.h9\",\n \"squid-migration-script-3.5.20-2.2.h9\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T09:07:11", "description": "According to the versions of the squid package installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerabilities :\n\n - Squid before 4.9, when certain web browsers are used,\n mishandles HTML in the host (aka hostname) parameter to\n cachemgr.cgi.(CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 3, "cvss3": {"score": 8.8, "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-12-14T00:00:00", "title": "EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15810", "CVE-2019-18860", "CVE-2020-15049"], "modified": "2020-12-14T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:squid", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-2534.NASL", "href": "https://www.tenable.com/plugins/nessus/144150", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(144150);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-18860\",\n \"CVE-2020-15049\",\n \"CVE-2020-15810\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the squid package installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerabilities :\n\n - Squid before 4.9, when certain web browsers are used,\n mishandles HTML in the host (aka hostname) parameter to\n cachemgr.cgi.(CVE-2019-18860)\n\n - An issue was discovered in Squid before 4.13 and 5.x\n before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and\n HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass\n local security and poison the proxy cache and any\n downstream caches with content from an arbitrary\n source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace\n characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a\n conflicting length to be used from another\n Content-Length header) but relayed\n upstream.(CVE-2020-15810)\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2534\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7e6b5c34\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/12/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/12/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"squid-4.2-2.h11.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2020-11-19T01:20:03", "description": "The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by\nmultiple vulnerabilities as referenced in the ALAS-2020-1453 advisory.\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the proxy cache and any\n downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a\n conflicting length to be used from another Content-Length header) but relayed upstream. (CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the browser cache and\n any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request\n inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request\n delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any\n downstream caches. (CVE-2020-15811)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all\n available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when\n cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()\n livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 1, "cvss3": {"score": 7.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "published": "2020-11-18T00:00:00", "title": "Amazon Linux AMI : squid (ALAS-2020-1453)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15811", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2020-8449"], "modified": "2020-11-18T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:squid-debuginfo", "p-cpe:/a:amazon:linux:squid", "p-cpe:/a:amazon:linux:squid-migration-script", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2020-1453.NASL", "href": "https://www.tenable.com/plugins/nessus/142983", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n# \n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2020-1453.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142983);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/11/18\");\n\n script_cve_id(\n \"CVE-2019-12528\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-15049\",\n \"CVE-2020-15810\",\n \"CVE-2020-15811\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"ALAS\", value:\"2020-1453\");\n\n script_name(english:\"Amazon Linux AMI : squid (ALAS-2020-1453)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Amazon Linux AMI host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by\nmultiple vulnerabilities as referenced in the ALAS-2020-1453 advisory.\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the proxy cache and any\n downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a\n conflicting length to be used from another Content-Length header) but relayed upstream. (CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the browser cache and\n any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request\n inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request\n delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any\n downstream caches. (CVE-2020-15811)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all\n available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when\n cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()\n livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/ALAS-2020-1453.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-15049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-15810\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-15811\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-24606\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-8449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-8450\");\n script_set_attribute(attribute:\"solution\", value:\n\"Run 'yum update squid' to update your system.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/18\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\npkgs = [\n {'reference':'squid-3.5.20-17.41.amzn1', 'cpu':'i686', 'release':'ALA'},\n {'reference':'squid-3.5.20-17.41.amzn1', 'cpu':'x86_64', 'release':'ALA'},\n {'reference':'squid-debuginfo-3.5.20-17.41.amzn1', 'cpu':'i686', 'release':'ALA'},\n {'reference':'squid-debuginfo-3.5.20-17.41.amzn1', 'cpu':'x86_64', 'release':'ALA'},\n {'reference':'squid-migration-script-3.5.20-17.41.amzn1', 'cpu':'i686', 'release':'ALA'},\n {'reference':'squid-migration-script-3.5.20-17.41.amzn1', 'cpu':'x86_64', 'release':'ALA'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid / squid-debuginfo / squid-migration-script\");\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-01T09:37:35", "description": "The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4082 advisory.\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: HTTP Request Smuggling could result in cache poisoning (CVE-2020-15810)\n\n - squid: HTTP Request Splitting could result in cache poisoning (CVE-2020-15811)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 3, "cvss3": {"score": 7.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "published": "2020-11-06T00:00:00", "title": "CentOS 7 : squid (CESA-2020:4082)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15811", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2020-8449"], "modified": "2020-11-06T00:00:00", "cpe": ["cpe:/o:centos:centos:7", "p-cpe:/a:centos:centos:squid", "p-cpe:/a:centos:centos:squid-sysvinit", "p-cpe:/a:centos:centos:squid-migration-script"], "id": "CENTOS_RHSA-2020-4082.NASL", "href": "https://www.tenable.com/plugins/nessus/142599", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:4082 and\n# CentOS Errata and Security Advisory 2020:4082 respectively.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142599);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/11/30\");\n\n script_cve_id(\n \"CVE-2019-12528\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-15049\",\n \"CVE-2020-15810\",\n \"CVE-2020-15811\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4082\");\n\n script_name(english:\"CentOS 7 : squid (CESA-2020:4082)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2020:4082 advisory.\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: HTTP Request Smuggling could result in cache poisoning (CVE-2020-15810)\n\n - squid: HTTP Request Splitting could result in cache poisoning (CVE-2020-15811)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n # https://lists.centos.org/pipermail/centos-cr-announce/2020-November/012886.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2868677d\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/20.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/200.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/444.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid, squid-migration-script and / or squid-sysvinit packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(20, 119, 200, 444);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/06\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:squid-sysvinit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'CentOS 7.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\npkgs = [\n {'reference':'squid-3.5.20-17.el7_9.4', 'sp':'9', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'squid-migration-script-3.5.20-17.el7_9.4', 'sp':'9', 'cpu':'x86_64', 'release':'CentOS-7'},\n {'reference':'squid-sysvinit-3.5.20-17.el7_9.4', 'sp':'9', 'cpu':'x86_64', 'release':'CentOS-7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n cr_plugin_caveat = '\\n' +\n 'NOTE: The security advisory associated with this vulnerability has a\\n' +\n 'fixed package version that may only be available in the continuous\\n' +\n 'release (CR) repository for CentOS, until it is present in the next\\n' +\n 'point release of CentOS.\\n\\n' +\n 'If an equal or higher package level does not exist in the baseline\\n' +\n 'repository for your major version of CentOS, then updates from the CR\\n' +\n 'repository will need to be applied in order to address the\\n' +\n 'vulnerability.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + cr_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'squid / squid-migration-script / squid-sysvinit');\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-11-21T06:06:00", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "edition": 3, "cvss3": {"score": 7.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "published": "2020-11-04T00:00:00", "title": "RHEL 8 : squid:4 (RHSA-2020:4743)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12529", "CVE-2019-12528", "CVE-2019-18677", "CVE-2019-12523", "CVE-2020-24606", "CVE-2019-18678", "CVE-2019-12524", "CVE-2019-12520", "CVE-2019-12521", "CVE-2019-18676", "CVE-2019-18860", "CVE-2020-8450", "CVE-2020-15049", "CVE-2019-12854", "CVE-2020-14058", "CVE-2019-12526", "CVE-2019-18679", "CVE-2020-8449"], "modified": "2020-11-04T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:squid", "p-cpe:/a:redhat:enterprise_linux:libecap", "p-cpe:/a:redhat:enterprise_linux:libecap-devel", "p-cpe:/a:redhat:enterprise_linux:squid-debugsource", "cpe:/a:redhat:enterprise_linux:8::appstream", "p-cpe:/a:redhat:enterprise_linux:libecap-debugsource", "cpe:/o:redhat:enterprise_linux:8"], "id": "REDHAT-RHSA-2020-4743.NASL", "href": "https://www.tenable.com/plugins/nessus/142412", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:4743. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142412);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/11/19\");\n\n script_cve_id(\n \"CVE-2019-12520\",\n \"CVE-2019-12521\",\n \"CVE-2019-12523\",\n \"CVE-2019-12524\",\n \"CVE-2019-12526\",\n \"CVE-2019-12528\",\n \"CVE-2019-12529\",\n \"CVE-2019-12854\",\n \"CVE-2019-18676\",\n \"CVE-2019-18677\",\n \"CVE-2019-18678\",\n \"CVE-2019-18679\",\n \"CVE-2019-18860\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-14058\",\n \"CVE-2020-15049\",\n \"CVE-2020-24606\"\n );\n script_xref(name:\"RHSA\", value:\"2020:4743\");\n\n script_name(english:\"RHEL 8 : squid:4 (RHSA-2020:4743)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4743 advisory.\n\n - squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n - squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n - squid: Improper input validation in URI processor (CVE-2019-12523)\n\n - squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n - squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n - squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n - squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n - squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n - squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n - squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n - squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n - squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n - squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n - squid: DoS in TLS handshake (CVE-2020-14058)\n\n - squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\n - squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/20.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/79.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/122.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/200.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/400.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/444.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/676.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12520\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12521\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12524\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12526\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12529\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-12854\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18676\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18677\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18678\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18679\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2019-18860\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-8449\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-8450\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14058\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-15049\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-24606\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:4743\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1730523\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1730528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770349\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770356\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770360\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770365\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770371\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1770375\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1798534\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1798540\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1798552\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1817121\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1827558\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1827562\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1827570\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1852550\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1852554\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1871705\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(20, 79, 119, 122, 200, 400, 444, 676);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:enterprise_linux:8::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libecap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libecap-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libecap-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:squid-debugsource\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nrepositories = {\n 'enterprise_linux_8_appstream': [\n 'rhel-8-for-aarch64-appstream-debug-rpms',\n 'rhel-8-for-aarch64-appstream-rpms',\n 'rhel-8-for-aarch64-appstream-source-rpms',\n 'rhel-8-for-s390x-appstream-debug-rpms',\n 'rhel-8-for-s390x-appstream-rpms',\n 'rhel-8-for-s390x-appstream-source-rpms',\n 'rhel-8-for-x86_64-appstream-debug-rpms',\n 'rhel-8-for-x86_64-appstream-rpms',\n 'rhel-8-for-x86_64-appstream-source-rpms'\n ]\n};\n\nfound_repos = NULL;\nhost_repo_list = get_kb_list('Host/RedHat/repo-list/*');\nif (!(empty_or_null(host_repo_list))) {\n found_repos = make_list();\n foreach repo_key (keys(repositories)) {\n foreach repo ( repositories[repo_key] ) {\n if (get_kb_item('Host/RedHat/repo-list/' + repo)) {\n append_element(var:found_repos, value:repo_key);\n break;\n }\n }\n }\n if(empty_or_null(found_repos)) audit(AUDIT_RHSA_NOT_AFFECTED, 'RHSA-2020:4743');\n}\n\nmodule_ver = get_kb_item('Host/RedHat/appstream/squid');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\nif ('4' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module squid:' + module_ver);\n\nappstreams = {\n 'squid:4': [\n {'reference':'libecap-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-debugsource-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-debugsource-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-debugsource-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'libecap-devel-1.0.1-2.module+el8.1.0+4044+36416a77', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'squid-4.11-3.module+el8.3.0+7851+7808b5f9', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7', 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'squid-4.11-3.module+el8.3.0+7851+7808b5f9', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7', 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'squid-4.11-3.module+el8.3.0+7851+7808b5f9', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7', 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'squid-debugsource-4.11-3.module+el8.3.0+7851+7808b5f9', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7', 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'squid-debugsource-4.11-3.module+el8.3.0+7851+7808b5f9', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7', 'repo_list':['enterprise_linux_8_appstream']},\n {'reference':'squid-debugsource-4.11-3.module+el8.3.0+7851+7808b5f9', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'7', 'repo_list':['enterprise_linux_8_appstream']}\n ]\n};\n\nflag = 0;\nappstreams_found = 0;\nforeach module (keys(appstreams)) {\n appstream = NULL;\n appstream_name = NULL;\n appstream_version = NULL;\n appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach package_array ( appstreams[module] ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n repo_list = NULL;\n if (!empty_or_null(package_array['repo_list'])) repo_list = package_array['repo_list'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n repocheck = FALSE;\n if (empty_or_null(found_repos))\n {\n repocheck = TRUE;\n }\n else\n {\n foreach repo (repo_list) {\n if (contains_element(var:found_repos, value:repo))\n {\n repocheck = TRUE;\n break;\n }\n }\n }\n if (repocheck && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module squid:4');\n\nif (flag)\n{\n if (empty_or_null(host_repo_list)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libecap / libecap-debugsource / libecap-devel / squid / etc');\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T09:06:48", "description": "According to the versions of the squid package installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in Squid before 4.12 and 5.x\n before 5.0.3. Due to use of a potentially dangerous\n function, Squid and the default certificate validation\n helper are vulnerable to a Denial of Service when\n opening a TLS connection to an attacker-controlled\n server for HTTPS. This occurs because unrecognized\n error values are mapped to NULL, but later code expects\n that each error value is mapped to a valid error\n string.(CVE-2020-14058)\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 4, "cvss3": {"score": 8.8, "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-10-30T00:00:00", "title": "EulerOS 2.0 SP5 : squid (EulerOS-SA-2020-2273)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15049", "CVE-2020-14058"], "modified": "2020-10-30T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:squid", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2020-2273.NASL", "href": "https://www.tenable.com/plugins/nessus/142069", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142069);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2020-14058\",\n \"CVE-2020-15049\"\n );\n\n script_name(english:\"EulerOS 2.0 SP5 : squid (EulerOS-SA-2020-2273)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the squid package installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerabilities :\n\n - An issue was discovered in Squid before 4.12 and 5.x\n before 5.0.3. Due to use of a potentially dangerous\n function, Squid and the default certificate validation\n helper are vulnerable to a Denial of Service when\n opening a TLS connection to an attacker-controlled\n server for HTTPS. This occurs because unrecognized\n error values are mapped to NULL, but later code expects\n that each error value is mapped to a valid error\n string.(CVE-2020-14058)\n\n - An issue was discovered in\n http/ContentLengthInterpreter.cc in Squid before 4.12\n and 5.x before 5.0.3. A Request Smuggling and Poisoning\n attack can succeed against the HTTP cache. The client\n sends an HTTP request with a Content-Length header\n containing '+\\ '-' or an uncommon shell whitespace\n character prefix to the length\n field-value.(CVE-2020-15049)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-2273\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ea102d26\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/30\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"squid-4.8-3.h5.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid\");\n}\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2020-10-24T09:24:55", "description": "Security Fix(es) :\n\n - squid: HTTP Request Smuggling could result in cache\n poisoning (CVE-2020-15810)\n\n - squid: HTTP Request Splitting could result in cache\n poisoning (CVE-2020-15811)\n\n - squid: Information Disclosure issue in FTP Gateway\n (CVE-2019-12528)\n\n - squid: Improper input validation issues in HTTP Request\n processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations\n (CVE-2020-8450)\n\n - squid: Request smuggling and poisoning attack against\n the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS\n (CVE-2020-24606)", "edition": 2, "cvss3": {"score": 7.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "published": "2020-10-21T00:00:00", "title": "Scientific Linux Security Update : squid on SL7.x x86_64 (20201001)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15811", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2020-8449"], "modified": "2020-10-21T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:squid-sysvinit", "p-cpe:/a:fermilab:scientific_linux:squid", "p-cpe:/a:fermilab:scientific_linux:squid-debuginfo", "p-cpe:/a:fermilab:scientific_linux:squid-migration-script", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20201001_SQUID_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/nessus/141708", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(141708);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/23\");\n\n script_cve_id(\"CVE-2019-12528\", \"CVE-2020-15049\", \"CVE-2020-15810\", \"CVE-2020-15811\", \"CVE-2020-24606\", \"CVE-2020-8449\", \"CVE-2020-8450\");\n\n script_name(english:\"Scientific Linux Security Update : squid on SL7.x x86_64 (20201001)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Security Fix(es) :\n\n - squid: HTTP Request Smuggling could result in cache\n poisoning (CVE-2020-15810)\n\n - squid: HTTP Request Splitting could result in cache\n poisoning (CVE-2020-15811)\n\n - squid: Information Disclosure issue in FTP Gateway\n (CVE-2019-12528)\n\n - squid: Improper input validation issues in HTTP Request\n processing (CVE-2020-8449)\n\n - squid: Buffer overflow in reverse-proxy configurations\n (CVE-2020-8450)\n\n - squid: Request smuggling and poisoning attack against\n the HTTP cache (CVE-2020-15049)\n\n - squid: Improper input validation could result in a DoS\n (CVE-2020-24606)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind2010&L=SCIENTIFIC-LINUX-ERRATA&P=25201\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b374f573\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:squid-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:squid-sysvinit\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"squid-3.5.20-17.el7_9.4\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"squid-debuginfo-3.5.20-17.el7_9.4\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"squid-migration-script-3.5.20-17.el7_9.4\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"squid-sysvinit-3.5.20-17.el7_9.4\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"squid / squid-debuginfo / squid-migration-script / squid-sysvinit\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-10-10T16:44:31", "description": "The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2020-4082 advisory.\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the proxy cache and any\n downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a\n conflicting length to be used from another Content-Length header) but relayed upstream. (CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the browser cache and\n any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request\n inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request\n delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any\n downstream caches. (CVE-2020-15811)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all\n available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when\n cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()\n livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 2, "cvss3": {"score": 7.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "published": "2020-10-08T00:00:00", "title": "Oracle Linux 7 : squid (ELSA-2020-4082)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-15811", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2020-8449"], "modified": "2020-10-08T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:squid-sysvinit", "p-cpe:/a:oracle:linux:squid", "cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:squid-migration-script"], "id": "ORACLELINUX_ELSA-2020-4082.NASL", "href": "https://www.tenable.com/plugins/nessus/141309", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2020-4082.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141309);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/09\");\n\n script_cve_id(\n \"CVE-2019-12528\",\n \"CVE-2020-8449\",\n \"CVE-2020-8450\",\n \"CVE-2020-15049\",\n \"CVE-2020-15810\",\n \"CVE-2020-15811\",\n \"CVE-2020-24606\"\n );\n\n script_name(english:\"Oracle Linux 7 : squid (ELSA-2020-4082)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2020-4082 advisory.\n\n - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of\n sensitive information from heap memory, such as information associated with other users' sessions or non-\n Squid processes. (CVE-2019-12528)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted\n HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.\n (CVE-2020-8449)\n\n - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can\n cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)\n\n - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A\n Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP\n request with a Content-Length header containing +\\ - or an uncommon shell whitespace character prefix\n to the length field-value. (CVE-2020-15049)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the proxy cache and any\n downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the\n default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a\n prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a\n conflicting length to be used from another Content-Length header) but relayed upstream. (CVE-2020-15810)\n\n - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP\n Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This\n allows any client, including browser scripts, to bypass local security and poison the browser cache and\n any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing\n the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request\n inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request\n delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any\n downstream caches. (CVE-2020-15811)\n\n - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all\n available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when\n cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()\n livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://linux.oracle.com/errata/ELSA-2020-4082.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected squid, squid-migration-script and / or squid-sysvinit packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-8450\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:squid\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:squid-migration-script\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:squid-sysvinit\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\npkgs = [\n {'reference':'squid-3.5.20-17.el7_9.4', 'cpu':'x86_64', 'release':'7', 'epoch':'7'},\n {'reference':'squid-migration-script-3.5.20-17.el7_9.4', 'cpu':'x86_64', 'release':'7', 'epoch':'7'},\n {'reference':'squid-sysvinit-3.5.20-17.el7_9.4', 'cpu':'x86_64', 'release':'7', 'epoch':'7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'squid / squid-migration-script / squid-sysvinit');\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "amazon": [{"lastseen": "2020-11-18T07:21:34", "bulletinFamily": "unix", "cvelist": ["CVE-2020-15811", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2020-8449"], "description": "**Issue Overview:**\n\nAn issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes. ([CVE-2019-12528 __](<https://access.redhat.com/security/cve/CVE-2019-12528>))\n\nAn issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing \"+\\ \"-\" or an uncommon shell whitespace character prefix to the length field-value. ([CVE-2020-15049 __](<https://access.redhat.com/security/cve/CVE-2020-15049>))\n\nA flaw was found in squid. Due to incorrect data validation, a HTTP Request Smuggling attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity. ([CVE-2020-15810 __](<https://access.redhat.com/security/cve/CVE-2020-15810>))\n\nA flaw was found in squid. Due to incorrect data validation, an HTTP Request Splitting attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity. ([CVE-2020-15811 __](<https://access.redhat.com/security/cve/CVE-2020-15811>))\n\nSquid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. ([CVE-2020-24606 __](<https://access.redhat.com/security/cve/CVE-2020-24606>))\n\nAn issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters. ([CVE-2020-8449 __](<https://access.redhat.com/security/cve/CVE-2020-8449>))\n\nAn issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. ([CVE-2020-8450 __](<https://access.redhat.com/security/cve/CVE-2020-8450>))\n\n \n**Affected Packages:** \n\n\nsquid\n\n \n**Issue Correction:** \nRun _yum update squid_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n squid-3.5.20-17.41.amzn1.i686 \n squid-migration-script-3.5.20-17.41.amzn1.i686 \n squid-debuginfo-3.5.20-17.41.amzn1.i686 \n \n src: \n squid-3.5.20-17.41.amzn1.src \n \n x86_64: \n squid-3.5.20-17.41.amzn1.x86_64 \n squid-migration-script-3.5.20-17.41.amzn1.x86_64 \n squid-debuginfo-3.5.20-17.41.amzn1.x86_64 \n \n \n", "edition": 1, "modified": "2020-11-16T17:59:00", "published": "2020-11-16T17:59:00", "id": "ALAS-2020-1453", "href": "https://alas.aws.amazon.com/ALAS-2020-1453.html", "title": "Important: squid", "type": "amazon", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "centos": [{"lastseen": "2020-11-07T03:28:24", "bulletinFamily": "unix", "cvelist": ["CVE-2020-15811", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2020-8449"], "description": "**CentOS Errata and Security Advisory** CESA-2020:4082\n\n\nSquid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: HTTP Request Smuggling could result in cache poisoning (CVE-2020-15810)\n\n* squid: HTTP Request Splitting could result in cache poisoning (CVE-2020-15811)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2020-November/012886.html\n\n**Affected packages:**\nsquid\nsquid-migration-script\nsquid-sysvinit\n\n**Upstream details at:**\n", "edition": 1, "modified": "2020-11-06T22:15:00", "published": "2020-11-06T22:15:00", "id": "CESA-2020:4082", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2020-November/012886.html", "title": "squid security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2020-11-10T10:21:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12520", "CVE-2019-12521", "CVE-2019-12523", "CVE-2019-12524", "CVE-2019-12526", "CVE-2019-12528", "CVE-2019-12529", "CVE-2019-12854", "CVE-2019-18676", "CVE-2019-18677", "CVE-2019-18678", "CVE-2019-18679", "CVE-2019-18860", "CVE-2020-14058", "CVE-2020-15049", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "description": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)\n\nSecurity Fix(es):\n\n* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)\n\n* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)\n\n* squid: Improper input validation in URI processor (CVE-2019-12523)\n\n* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)\n\n* squid: Heap overflow issue in URN processing (CVE-2019-12526)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)\n\n* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)\n\n* squid: Buffer overflow in URI processor (CVE-2019-18676)\n\n* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)\n\n* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)\n\n* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)\n\n* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: DoS in TLS handshake (CVE-2020-14058)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.", "modified": "2020-11-04T05:02:31", "published": "2020-11-03T17:32:17", "id": "RHSA-2020:4743", "href": "https://access.redhat.com/errata/RHSA-2020:4743", "type": "redhat", "title": "(RHSA-2020:4743) Moderate: squid:4 security, bug fix, and enhancement update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-09-30T07:58:01", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12528", "CVE-2020-15049", "CVE-2020-15810", "CVE-2020-15811", "CVE-2020-24606", "CVE-2020-8449", "CVE-2020-8450"], "description": "Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: HTTP Request Smuggling could result in cache poisoning (CVE-2020-15810)\n\n* squid: HTTP Request Splitting could result in cache poisoning (CVE-2020-15811)\n\n* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)\n\n* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)\n\n* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)\n\n* squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)\n\n* squid: Improper input validation could result in a DoS (CVE-2020-24606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2020-09-30T10:05:50", "published": "2020-09-30T04:17:14", "id": "RHSA-2020:4082", "href": "https://access.redhat.com/errata/RHSA-2020:4082", "type": "redhat", "title": "(RHSA-2020:4082) Important: squid security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "oraclelinux": [{"lastseen": "2020-10-09T06:53:43", "bulletinFamily": "unix", "cvelist": ["CVE-2020-15811", "CVE-2019-12519", "CVE-2019-12528", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-8450", "CVE-2020-15049", "CVE-2019-12525", "CVE-2020-11945", "CVE-2020-8449"], "description": "[7:3.5.20-17.4]\n- Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could\n result in a DoS\n- Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could\n result in cache poisoning\n- Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could\n result in cache poisoning\n[7:3.5.20-17.2]\n- Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues\n in HTTP Request processing\n- Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting\n as reverse-proxy\n- Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning\n attack against the HTTP cache\n- Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in\n FTP Gateway\n[7:3.5.20-17]\n- Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon\n Digest Authentication nonce replay could lead to remote code execution\n- Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in\n ESIExpression::Evaluate allows for stack buffer overflow [rhel\n[7:3.5.20-16]\n- Resolves: #1738582 - CVE-2019-12525 squid: parsing of header\n Proxy-Authentication leads to memory corruption", "edition": 2, "modified": "2020-10-08T00:00:00", "published": "2020-10-08T00:00:00", "id": "ELSA-2020-4082", "href": "http://linux.oracle.com/errata/ELSA-2020-4082.html", "title": "squid security update", "type": "oraclelinux", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2020-10-03T00:55:49", "bulletinFamily": "unix", "cvelist": ["CVE-2020-15811", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-15049"], "description": "- -------------------------------------------------------------------------\nDebian LTS Advisory DLA-2394-1 debian-lts@lists.debian.org\nhttps://www.debian.org/lts/security/ Markus Koschany\nOctober 02, 2020 https://wiki.debian.org/LTS\n- -------------------------------------------------------------------------\n\nPackage : squid3\nVersion : 3.5.23-5+deb9u5\nCVE ID : CVE-2020-15049 CVE-2020-15810 CVE-2020-15811\n CVE-2020-24606\n\nSeveral security vulnerabilities have been discovered in Squid, a high-\nperformance proxy caching server for web clients.\n\nCVE-2020-15049\n\n An issue was discovered in http/ContentLengthInterpreter.cc in\n Squid. A Request Smuggling and Poisoning attack can succeed against\n the HTTP cache. The client sends an HTTP request with a Content-\n Length header containing &quot;+\\ &quot;-&quot; or an uncommon shell whitespace\n character prefix to the length field-value.\n This update also includes several other improvements to the\n HttpHeader parsing code.\n\nCVE-2020-15810 and CVE-2020-15811\n\n Due to incorrect data validation, HTTP Request Smuggling attacks may\n succeed against HTTP and HTTPS traffic. This leads to cache\n poisoning and allows any client, including browser scripts, to\n bypass local security and poison the proxy cache and any downstream\n caches with content from an arbitrary source. When configured for\n relaxed header parsing (the default), Squid relays headers\n containing whitespace characters to upstream servers. When this\n occurs as a prefix to a Content-Length header, the frame length\n specified will be ignored by Squid (allowing for a conflicting\n length to be used from another Content-Length header) but relayed\n upstream.\n\nCVE-2020-24606\n\n Squid allows a trusted peer to perform Denial of Service by\n consuming all available CPU cycles during handling of a crafted\n Cache Digest response message. This only occurs when cache_peer is\n used with the cache digests feature. The problem exists because\n peerDigestHandleReply() livelocking in peer_digest.cc mishandles\n EOF.\n\nFor Debian 9 stretch, these problems have been fixed in version\n3.5.23-5+deb9u5.\n\nWe recommend that you upgrade your squid3 packages.\n\nFor the detailed security status of squid3 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/squid3\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 1, "modified": "2020-10-02T16:30:11", "published": "2020-10-02T16:30:11", "id": "DEBIAN:DLA-2394-1:6349E", "href": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202010/msg00005.html", "title": "[SECURITY] [DLA 2394-1] squid3 security update", "type": "debian", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}], "ubuntu": [{"lastseen": "2020-09-29T01:04:13", "bulletinFamily": "unix", "cvelist": ["CVE-2020-15811", "CVE-2020-24606", "CVE-2020-15810", "CVE-2020-15049"], "description": "Alex Rousskov and Amit Klein discovered that Squid incorrectly handled \ncertain Content-Length headers. A remote attacker could possibly use this \nissue to perform an HTTP request smuggling attack, resulting in cache \npoisoning. (CVE-2020-15049)\n\nAmit Klein discovered that Squid incorrectly validated certain data. A \nremote attacker could possibly use this issue to perform an HTTP request \nsmuggling attack, resulting in cache poisoning. (CVE-2020-15810)\n\nR\u00e9gis Leroy discovered that Squid incorrectly validated certain data. A \nremote attacker could possibly use this issue to perform an HTTP request \nsplitting attack, resulting in cache poisoning. (CVE-2020-15811)\n\nLubos Uhliarik discovered that Squid incorrectly handled certain Cache \nDigest response messages sent by trusted peers. A remote attacker could \npossibly use this issue to cause Squid to consume resources, resulting in a \ndenial of service. (CVE-2020-24606)", "edition": 1, "modified": "2020-09-28T00:00:00", "published": "2020-09-28T00:00:00", "id": "USN-4551-1", "href": "https://ubuntu.com/security/notices/USN-4551-1", "title": "Squid vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}]}