The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-1130 advisory.

    [2.5.STABLE3-8.3E]
     - fix for #410181 - CVE-2007-6239 Squid DoS in cache updates

     [2.5.STABLE3-7]
     - resolves: #238103: 'forwarded_for off' in squid.conf does not work.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way squid stored HTTP headers for cached objects in system memory. An attacker could cause squid to use additional memory, and trigger high CPU usage when processing requests for certain cached objects, possibly leading to a denial of service.
(CVE-2007-6239)

This update of squid fixes a denial-of-service bug during cache update reply processing. (CVE-2007-6239)

The cache update reply processing functionality in Squid 2.x before 2.6.STABLE17, and Squid 3.0, allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers.

The updated package fixes this issue.

The remote host is affected by the vulnerability described in GLSA-200903-38 (Squid: Multiple Denial of Service vulnerabilities)

    The arrayShrink function in lib/Array.c can cause an array to     shrink to 0 entries, which triggers an assert error. NOTE: this issue     is due to an incorrect fix for CVE-2007-6239 (CVE-2008-1612).
    An invalid version number in a HTTP request may trigger an     assertion in HttpMsg.c and HttpStatusLine.c (CVE-2009-0478).
  Impact :

    The issues allows for Denial of Service attacks against the service via     an HTTP request with an invalid version number and other specially     crafted requests.
  Workaround :

    There is no known workaround at this time.

It was discovered that Squid did not perform proper bounds checking when processing cache update replies. A remote authenticated user may be able to trigger an assertion error and cause a denial of service.
This vulnerability is due to an incorrect upstream fix for CVE-2007-6239. (CVE-2008-1612).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated squid packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A flaw was found in the way squid manipulated HTTP headers for cached objects stored in system memory. An attacker could use this flaw to cause a squid child process to exit. This interrupted existing connections and made proxy services unavailable. Note: the parent squid process started a new child process, so this attack only resulted in a temporary denial of service. (CVE-2008-1612)

Users of squid are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

It was discovered that malformed cache update replies against the Squid WWW proxy cache could lead to the exhaustion of system memory, resulting in potential denial of service.

It was discovered that Squid did not always clean up cache memory correctly. A remote attacker could manipulate cache update replies and cause Squid to use all available memory, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200801-05 (Squid: Denial of Service)

    The Wikimedia Foundation reported a memory leak vulnerability when     performing cache updates.
  Impact :

    A remote attacker could perform numerous specially crafted requests to     the vulnerable server, resulting in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Updated squid packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A flaw was found in the way squid stored HTTP headers for cached objects in system memory. An attacker could cause squid to use additional memory, and trigger high CPU usage when processing requests for certain cached objects, possibly leading to a denial of service.
(CVE-2007-6239)

Users of squid are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

- Thu Dec 6 2007 Martin Nagy <mnagy at redhat.com> -     2.6.STABLE17-1

    - upgrade to latest upstream 2.6.STABLE17

    - Mon Nov 12 2007 Martin Bacovsky <mbacovsk at       redhat.com> - 7:2.6.STABLE16-3

    - squid is compiled wirh arp acls support       (--enable-arp-acl)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Dec 6 2007 Martin Nagy <mnagy at redhat.com> -     7:2.6.STABLE16-1

    - Upstream patch to fix CVE-2007-6239 (#410181)

    - Fri Sep 7 2007 Martin Bacovsky <mbacovsk at       redhat.com> - 7:2.6.STABLE16-1

    - upgrade to latest upstream 2.6.STABLE14

    - Wed Aug 1 2007 Martin Bacovsky <mbacovsk at       redhat.com> - 7:2.6.STABLE14-1

    - upgrade to latest upstream 2.6.STABLE14

    - Mon Jun 4 2007 Martin Bacovsky <mbacovsk at       redhat.com> - 7:2.6.STABLE13-1

    - update to latest upstream 2.6.STABLE13

    - resolves: #242423: Squid Version Violation

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Squid secuirty advisory reports :

Due to incorrect bounds checking Squid is vulnerable to a denial of service check during some cache update reply processing.

This problem allows any client trusted to use the service to perform a denial of service attack on the Squid service.

According to its banner, the version of the Squid proxy caching server installed on the remote host is older than 2.6.STABLE18. Such versions reportedly use incorrect bounds checking when processing some cache update replies. A client trusted to use the service may be able to leverage this issue to crash the application, thereby denying service to legitimate users.

Note that an earlier version of the advisory said 2.6.STABLE17 fixed the issue, but it turned out that the patch did not fully address the issue.

According to its banner, the version of the Squid proxy caching server installed on the remote host is older than 2.6.STABLE17.  Such versions reportedly use incorrect bounds checking when processing some cache update replies.  A client trusted to use the service may be able to leverage this issue to crash the application, thereby denying service to legitimate users. 

ID	Name	Product	Family	Severity
67623	Oracle Linux 5 : Moderate: / squid (ELSA-2007-1130)	Nessus	Oracle Linux Local Security Checks	high
60333	Scientific Linux Security Update : squid on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41172	SuSE9 Security Update : squid (YOU Patch Number 12004)	Nessus	SuSE Local Security Checks	medium
36545	Mandriva Linux Security Advisory : squid (MDVSA-2008:002)	Nessus	Mandriva Local Security Checks	medium
36013	GLSA-200903-38 : Squid: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31967	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : squid vulnerability (USN-601-1)	Nessus	Ubuntu Local Security Checks	medium
31947	CentOS 3 / 4 / 5 : squid (CESA-2008:0214)	Nessus	CentOS Local Security Checks	medium
38954	Debian DSA-1482-1 : squid - programming error	Nessus	Debian Local Security Checks	medium
29921	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : squid vulnerability (USN-565-1)	Nessus	Ubuntu Local Security Checks	medium
29909	GLSA-200801-05 : Squid: Denial of Service	Nessus	Gentoo Local Security Checks	medium
29824	SuSE 10 Security Update : squid (ZYPP Patch Number 4782)	Nessus	SuSE Local Security Checks	medium
29823	openSUSE 10 Security Update : squid (squid-4779)	Nessus	SuSE Local Security Checks	medium
29736	RHEL 2.1 / 3 / 4 / 5 : squid (RHSA-2007:1130)	Nessus	Red Hat Local Security Checks	medium
29730	CentOS 3 / 4 / 5 : squid (CESA-2007:1130)	Nessus	CentOS Local Security Checks	medium
29709	Fedora 8 : squid-2.6.STABLE17-1.fc8 (2007-4170)	Nessus	Fedora Local Security Checks	medium
29708	Fedora 7 : squid-2.6.STABLE16-2.fc7 (2007-4161)	Nessus	Fedora Local Security Checks	medium
29230	FreeBSD : Squid -- Denial of Service Vulnerability (6eb580d7-a29c-11dc-8919-001c2514716c)	Nessus	FreeBSD Local Security Checks	medium
29216	Squid < 2.6.STABLE18 Cache Update Reply Unspecified DoS	Nessus	Firewalls	medium
4305	Squid < 2.6.STABLE18 Update Reply Processing DoS	Nessus Network Monitor	Web Servers	medium
801042	Squid < 2.6.STABLE18 Update Reply Processing DoS	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2007-6239

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high