The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issue :

  - 727492: Invalid free by processing CNAME (CVE-2011-4096)

This update also fixes the following non-security issue :

  - 737905: installation creates empty spurious file '/1'

The remote host is affected by the vulnerability described in GLSA-201309-22 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to bypass ACL restrictions or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-1791 advisory.

    [-7:3.1.10-1.el6_2.1]
    - Resolves: #755016 - CVE-2011-4096: Invalid free by processing CNAME DNS record

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability has been discovered and corrected in squid :

The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record (CVE-2011-4096).

The updated packages have been patched to correct this issue.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. 

An input validation flaw was found in the way Squid calculated the total number of resource records in the answer section of multiple name server responses. An attacker could use this flaw to cause Squid to crash. (CVE-2011-4096)

Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

This update fixes the following security issue :

  - 727492: Invalid free by processing CNAME (CVE-2011-4096)     It also fixes the following non-security issue :

  - 737905: installation creates empty spurious file '/1'

It was discovered that the IPv6 support code in Squid does not properly handle certain DNS responses, resulting in deallocation of an invalid pointer and a daemon crash.

The squid package and the version of Squid 3 shipped in lenny lack IPv6 support and are not affected by this issue.

An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

An input validation flaw was found in the way Squid calculated the total number of resource records in the answer section of multiple name server responses. An attacker could use this flaw to cause Squid to crash. (CVE-2011-4096)

Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.

According to its banner, the version of Squid is 3.1.x earlier than than 3.1.16 or 3.2.x earlier than 3.2.0.13. Such versions are affected by a denial of service vulnerability.

The application does not properly free memory when handling DNS replies containing a CNAME record that references another CNAME record that contains an empty A record.

Note that Nessus has relied only on the version in the proxy server's banner, which is not updated by the patch that the project has released to address the issue. If the patch has been applied properly and the service restarted, consider this to be a false positive.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1791 advisory.

    Squid is a high-performance proxy caching server for web clients,     supporting FTP, Gopher, and HTTP data objects.

    An input validation flaw was found in the way Squid calculated the total     number of resource records in the answer section of multiple name server     responses. An attacker could use this flaw to cause Squid to crash.
    (CVE-2011-4096)

    Users of squid should upgrade to this updated package, which contains a     backported patch to correct this issue. After installing this update, the     squid service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Upstream bugfix release fixing invalid free on certain DNS responses

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream bugfix update fixing invalid free on certain DNS responses

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
76031	openSUSE Security Update : squid3 (openSUSE-SU-2012:0213-1)	Nessus	SuSE Local Security Checks	medium
70182	GLSA-201309-22 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68401	Oracle Linux 6 : squid (ELSA-2011-1791)	Nessus	Oracle Linux Local Security Checks	high
61941	Mandriva Linux Security Advisory : squid (MDVSA-2011:193)	Nessus	Mandriva Local Security Checks	medium
61199	Scientific Linux Security Update : squid on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57727	SuSE 11.1 Security Update : squid3 (SAT Patch Number 5583)	Nessus	SuSE Local Security Checks	medium
57521	Debian DSA-2381-1 : squid3 - invalid memory deallocation	Nessus	Debian Local Security Checks	medium
57376	CentOS 6 : squid (CESA-2011:1791)	Nessus	CentOS Local Security Checks	medium
57287	Squid 3.1.x < 3.1.16 / 3.2.x < 3.2.0.13 DNS Replies CName Record Parsing Remote DoS	Nessus	Firewalls	medium
57037	RHEL 6 : squid (RHSA-2011:1791)	Nessus	Red Hat Local Security Checks	high
56864	Fedora 14 : squid-3.1.16-1.fc14 (2011-15256)	Nessus	Fedora Local Security Checks	medium
56863	Fedora 15 : squid-3.1.16-1.fc15 (2011-15233)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4096

high

Tenable Plugins

high

high

medium

high

high

medium

medium

medium

medium

medium

medium

high

medium

medium