Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: buffer overflow in cachemgr.cgi (CVE-2016-4051)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

  - Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x     before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory     consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication     credentials. (CVE-2012-5643)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: assertion failure in Range header processing (SQUID-2014:2) (CVE-2014-3609)

  - squid: off-by-one error in snmpHandleUdp() leading to a bss-based buffer overflow (SQUID-2014:3)     (CVE-2014-6270)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

  - squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Security Fix(es) :

  - A buffer overflow flaw was found in the way the Squid     cachemgr.cgi utility processed remotely relayed Squid     input. When the CGI interface utility is used, a remote     attacker could possibly use this flaw to execute     arbitrary code. (CVE-2016-4051)

  - Buffer overflow and input validation flaws were found in     the way Squid processed ESI responses. If Squid was used     as a reverse proxy, or for TLS/HTTPS interception, a     remote attacker able to control ESI components on an     HTTP server could use these flaws to crash Squid,     disclose parts of the stack memory, or possibly execute     arbitrary code as the user running Squid.
    (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

  - An input validation flaw was found in the way Squid     handled intercepted HTTP Request messages. An attacker     could use this flaw to bypass the protection against     issues related to CVE-2009-0801, and perform cache     poisoning attacks on Squid. (CVE-2016-4553)

  - An input validation flaw was found in Squid's     mime_get_header_field() function, which is used to     search for headers within HTTP requests. An attacker     could send an HTTP request from the client side with     specially crafted header Host header that bypasses     same-origin security protections, causing Squid     operating as interception or reverse-proxy to contact     the wrong origin server. It could also be used for cache     poisoning for client not following RFC 7230.
    (CVE-2016-4554)

  - A NULL pointer dereference flaw was found in the way     Squid processes ESI responses. If Squid was used as a     reverse proxy or for TLS/HTTPS interception, a malicious     server could use this flaw to crash the Squid worker     process. (CVE-2016-4555)

  - An incorrect reference counting flaw was found in the     way Squid processes ESI responses. If Squid is     configured as reverse-proxy, for TLS/HTTPS interception,     an attacker controlling a server accessed by Squid,     could crash the squid worker, causing a Denial of     Service attack. (CVE-2016-4556)

The remote host is affected by the vulnerability described in GLSA-201309-22 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to bypass ACL restrictions or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
198537	RHEL 5 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198516	RHEL 4 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198515	RHEL 6 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
91645	Scientific Linux Security Update : squid34 on SL6.x i386/x86_64 (20160531)	Nessus	Scientific Linux Local Security Checks	high
91513	Scientific Linux Security Update : squid on SL7.x x86_64 (20160531)	Nessus	Scientific Linux Local Security Checks	high
70182	GLSA-201309-22 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2009-0801

critical

Tenable Plugins

high

high

critical

high

high

high