lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - squid: assertion failure in Range header processing (SQUID-2014:2) (CVE-2014-3609)

  - squid: off-by-one error in snmpHandleUdp() leading to a bss-based buffer overflow (SQUID-2014:3)     (CVE-2014-6270)

  - Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote     endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and     probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web     page that causes a client to send HTTP requests with a modified Host header. (CVE-2009-0801)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2010-0221 advisory.

    - Resolves: #561828 - CVE-2009-2855 CVE-2010-0308 squid various flaws [rhel-5.5]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way Squid processed certain external ACL helper HTTP header fields that contained a delimiter that was not a comma. A remote attacker could issue a crafted request to the Squid server, causing excessive CPU use (up to 100%). (CVE-2009-2855)

Note: The CVE-2009-2855 issue only affected non-default configurations that use an external ACL helper script.

A flaw was found in the way Squid handled truncated DNS replies. A remote attacker able to send specially crafted UDP packets to Squid's DNS client port could trigger an assertion failure in Squid's child process, causing that child process to exit. (CVE-2010-0308)

This update also fixes the following bugs :

  - Squid's init script returns a non-zero value when trying     to stop a stopped service. This is not LSB compliant and     can generate difficulties in cluster environments. This     update makes stopping LSB compliant. (BZ#521926)

  - Squid is not currently built to support MAC address     filtering in ACLs. This update includes support for MAC     address filtering. (BZ#496170)

  - Squid is not currently built to support Kerberos     negotiate authentication. This update enables Kerberos     authentication. (BZ#516245)

  - Squid does not include the port number as part of URIs     it constructs when configured as an accelerator. This     results in a 403 error. This update corrects this     behavior. (BZ#538738)

  - the error_map feature does not work if the same handling     is set also on the HTTP server that operates in deflate     mode. This update fixes this issue. (BZ#470843)

After installing this update, the squid service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-24 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote unauthenticated attackers may be able to execute arbitrary code       with the privileges of the Squid process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The following vulnerabilities have been fixed in squid :

  - DoS via special crafted auth header CVE-2010-0308: DoS     via invalid DoS header. (CVE-2009-2855)

An updated squid package that fixes two security issues and several bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid processed certain external ACL helper HTTP header fields that contained a delimiter that was not a comma. A remote attacker could issue a crafted request to the Squid server, causing excessive CPU use (up to 100%). (CVE-2009-2855)

Note: The CVE-2009-2855 issue only affected non-default configurations that use an external ACL helper script.

A flaw was found in the way Squid handled truncated DNS replies. A remote attacker able to send specially crafted UDP packets to Squid's DNS client port could trigger an assertion failure in Squid's child process, causing that child process to exit. (CVE-2010-0308)

This update also fixes the following bugs :

* Squid's init script returns a non-zero value when trying to stop a stopped service. This is not LSB compliant and can generate difficulties in cluster environments. This update makes stopping LSB compliant. (BZ#521926)

* Squid is not currently built to support MAC address filtering in ACLs. This update includes support for MAC address filtering.
(BZ#496170)

* Squid is not currently built to support Kerberos negotiate authentication. This update enables Kerberos authentication.
(BZ#516245)

* Squid does not include the port number as part of URIs it constructs when configured as an accelerator. This results in a 403 error. This update corrects this behavior. (BZ#538738)

* the error_map feature does not work if the same handling is set also on the HTTP server that operates in deflate mode. This update fixes this issue. (BZ#470843)

All users of squid should upgrade to this updated package, which resolves these issues. After installing this update, the squid service will be restarted automatically.

The following vulnerabilities have been fixed in squid :

  - DoS via special crafted auth header. (CVE-2009-2855)

  - DoS via invalid DoS header. (CVE-2010-0308)

The following vulnerabilities have been fixed in squid :

  - CVE-2009-2855: DoS via special crafted auth header

  - CVE-2010-0308: DoS via invalid DoS header

  - CVE-2009-2622: DoS in squid3 via broken HTTP handling

  - CVE-2009-2621: DoS in squid3 via not enforced 'buffer     limits and related bound checks'

Two denial of service vulnerabilities have been discovered in squid and squid3, a web proxy. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2855     Bastian Blank discovered that it is possible to cause a     denial of service via a crafted auth header with certain     comma delimiters.

  - CVE-2010-0308     Tomas Hoger discovered that it is possible to cause a     denial of service via invalid DNS header-only packets.

It was discovered that Squid incorrectly handled certain auth headers.
A remote attacker could exploit this with a specially crafted auth header and cause Squid to go into an infinite loop, resulting in a denial of service. This issue only affected Ubuntu 8.10, 9.04 and 9.10. (CVE-2009-2855)

It was discovered that Squid incorrectly handled certain DNS packets.
A remote attacker could exploit this with a specially crafted DNS packet and cause Squid to crash, resulting in a denial of service.
(CVE-2010-0308).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability have been discovered and corrected in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15, which allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header (CVE-2010-0308).

This update provides a fix to this vulnerability.

According to its banner, the version of Squid proxy caching server installed on the remote host is 2.x or 3.x earlier than 3.0.STABLE23 or 3.1.0.16.  Such versions reportedly use incorrect data validation when processing specially crafted DNS packets.  An attacker, exploiting this flaw, could cause a short term denial of service.

According to its banner, the version of the Squid proxy caching server installed on the remote host is 2.x or older than 3.0.STABLE23 / 3.1.0.16. Such versions reportedly fail to correctly validate DNS packets, which can be abused by a remote attack to cause a short-term denial of service.

Note that Nessus has relied only on the version in the proxy server's banner, which is not updated by either of the patches the project has released to address this issue. If one of those has been applied properly and the service restarted, consider this to be a false positive.

Squid security advisory 2010:1 reports :

Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted DNS packets.

This problem allows any trusted client or external server who can determine the squid receiving port to perform a short-term denial of service attack on the Squid service.

ID	Name	Product	Family	Severity
198516	RHEL 4 : squid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
181029	Oracle Linux 5 : squid (ELSA-2010-0221)	Nessus	Oracle Linux Local Security Checks	high
60775	Scientific Linux Security Update : squid on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56658	GLSA-201110-24 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
49925	SuSE 10 Security Update : squid (ZYPP Patch Number 6931)	Nessus	SuSE Local Security Checks	medium
46285	RHEL 5 : squid (RHSA-2010:0221)	Nessus	Red Hat Local Security Checks	medium
45132	SuSE 10 Security Update : squid (ZYPP Patch Number 6930)	Nessus	SuSE Local Security Checks	medium
45131	SuSE 11 Security Update : squid (SAT Patch Number 2143)	Nessus	SuSE Local Security Checks	medium
45129	openSUSE Security Update : squid (squid-2144)	Nessus	SuSE Local Security Checks	medium
45127	openSUSE Security Update : squid (squid-2144)	Nessus	SuSE Local Security Checks	medium
45126	openSUSE Security Update : squid (squid-2144)	Nessus	SuSE Local Security Checks	medium
45125	SuSE9 Security Update : squid (YOU Patch Number 12597)	Nessus	SuSE Local Security Checks	medium
44855	Debian DSA-1991-1 : squid/squid3 - denial of service	Nessus	Debian Local Security Checks	medium
44641	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : squid vulnerabilities (USN-901-1)	Nessus	Ubuntu Local Security Checks	medium
44402	Mandriva Linux Security Advisory : squid (MDVSA-2010:033)	Nessus	Mandriva Local Security Checks	medium
801045	Squid 3.0STABLE23 / 3.1.0.16 Remote DoS	Log Correlation Engine	Web Servers	medium
5332	Squid < 3.0STABLE23 / 3.1.x < 3.1.0.16 Remote DoS	Nessus Network Monitor	Web Servers	medium
44384	Squid < 3.0.STABLE23 / 3.1.0.16	Nessus	Firewalls	medium
44345	FreeBSD : squid -- Denial of Service vulnerability in DNS handling (296ecb59-0f6b-11df-8bab-0019996bc1f7)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-0308

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium