CVE-2022-41318

2022-09-2300:00:00

ubuntu.com

buffer over-read

libntlmauth

squid

integer-overflow

sspi

smb

cleartext credentials

vulnerability

unix

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

41.0%

JSON

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6.
Due to incorrect integer-overflow protection, the SSPI and SMB
authentication helpers are vulnerable to reading unintended memory
locations. In some configurations, cleartext credentials from these
locations are sent to a client. This is fixed in 5.7.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchsquid< 4.10-1ubuntu1.7UNKNOWN
ubuntu22.04noarchsquid< 5.2-1ubuntu4.2UNKNOWN
ubuntu22.10noarchsquid< 5.6-1ubuntu3UNKNOWN
ubuntu23.04noarchsquid< 5.6-1ubuntu3UNKNOWN
ubuntu23.10noarchsquid< 5.6-1ubuntu3UNKNOWN
ubuntu24.04noarchsquid< 5.6-1ubuntu3UNKNOWN
ubuntu18.04noarchsquid3< 3.5.27-1ubuntu1.14UNKNOWN
ubuntu16.04noarchsquid3< 3.5.12-1ubuntu7.16+esm3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	squid	< 4.10-1ubuntu1.7	UNKNOWN
ubuntu	22.04	noarch	squid	< 5.2-1ubuntu4.2	UNKNOWN
ubuntu	22.10	noarch	squid	< 5.6-1ubuntu3	UNKNOWN
ubuntu	23.04	noarch	squid	< 5.6-1ubuntu3	UNKNOWN
ubuntu	23.10	noarch	squid	< 5.6-1ubuntu3	UNKNOWN
ubuntu	24.04	noarch	squid	< 5.6-1ubuntu3	UNKNOWN
ubuntu	18.04	noarch	squid3	< 3.5.27-1ubuntu1.14	UNKNOWN
ubuntu	16.04	noarch	squid3	< 3.5.12-1ubuntu7.16+esm3	UNKNOWN