Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - Fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - Regression caused by the DoS fixes above (bsc#993299)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - Multiple issues in pinger ICMP processing.
    (CVE-2014-7141, CVE-2014-7142)

  - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6     processing. (bsc#973782)

  - CVE-2016-4554: fix header smuggling issue in HTTP     Request processing (bsc#979010)

  - fix multiple Denial of Service issues in HTTP Response     processing. (CVE-2016-2569, CVE-2016-2570,     CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393,     bsc#968394, bsc#968395)

  - CVE-2016-3948: Fix denial of service in HTTP Response     processing (bsc#973783)

  - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi     (bsc#976553)

  - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054 :

  - fixes multiple issues in ESI processing (bsc#976556)

  - CVE-2016-4556: fixes double free vulnerability in Esi.cc     (bsc#979008)

  - CVE-2015-5400: Improper Protection of Alternate Path     (bsc#938715)

  - CVE-2014-6270: fix off-by-one in snmp subsystem     (bsc#895773)

  - Memory leak in squid3 when using external_acl     (bsc#976708)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. (CVE-2014-0128)

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

After installing this update, the squid service will be restarted automatically.

An updated squid package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115)

Red Hat would like to thank the Squid project for reporting the CVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the original reporter.

All Squid users are advised to upgrade to this updated package, which contains backported patches to correct these issues. After installing this update, the squid service will be restarted automatically.

The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2014-1148 advisory.

    - Resolves: #1134936 - CVE-2013-4115 buffer overflow when processing overly long DNS names

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This squid3 update includes several security fixes and minor changes.

  -     squid-3.1.x-bnc829084-CVE-2013-4115-BO_request_handling.
    diff Squid advisory SQUID-2013_2, CVE-2013-4115,     [bnc#829084] Specially crafted http requests can trigger     a buffer overflow when squid attempts to resolve an     overly long hostname.

  - run logrotate as squid:nogroup [bnc#677335]

This squid update includes several security fixes and minor changes.

  - squid-3.2.x-11823-bnc829084-CVE-2013-4115.diff fixes a     buffer overflow involving very long hostnames.
    [bnc#829084] CVE-2013-4115

  - squid-3.2.x-11823-bnc830319-CVE-2013-4123.diff fixes     problems identifying a port number as specified by the     client. [bnc#830319] CVE-2013-4123

  - run logrotate as squid:nogroup [bnc#677335]

This squid update includes several security fixes and minor changes.

  -     squid-2.7.x-bnc829084-CVE-2013-4115-BO_request_handling.
    diff Squid advisory SQUID-2013_2, CVE-2013-4115,     [bnc#829084] Specially crafted http requests can trigger     a buffer overflow when squid attempts to resolve an     overly long hostname.

  -     squid-2.7.x-bnc796999-bnc794954-CVE-2012-5643-CVE-2013-0     188-cachemgr_cgi_dos.diff memory leak in cachemgr.cgi     known as CVE-2013-0189, which is the underfixed     CVE-2012-5643 problem. [bnc#796999] [bnc#794954]

  - run logrotate as squid:nogroup [bnc#677335]

The remote host is affected by the vulnerability described in GLSA-201309-22 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to bypass ACL restrictions or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This squid update fixes a buffer overflow issue when squid attempts to resolve an overly long hostname. This can be triggered with specially crafted http requests. (bnc#829084, CVE-2013-4115)

This update also includes a correction to the last change for logrotate. (bnc#677335)

This is security update that fixes CVE-2013-4123 and CVE-2013-4115.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in squid :

Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger a buffer overflow in Squid, resulting in a termination of the Squid service (CVE-2013-4115).

The updated packages have been patched to correct this issue.

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.2.12 or 3.3.x prior to 3.3.7 and is, therefore, affected by a denial of service vulnerability.  A buffer overflow exists in the 'idnsALookup' function in the file 'dns_internal.cc' that could allow specially crafted HTTP requests that could result in a denial of service.

Note that Nessus has relied only on the version in the proxy server's banner, which is not updated by the patch that the project has released to address this issue.  If this patch has been applied properly and the service has been restarted, consider this to be a false positive.

Squid version prior to 3.x to 3.2.12 or 3.3.x prior to 3.3.7 are potentially affected by a denial of service vulnerability. A buffer overflow exists in the 'idnsALookup' function in the file 'dns_internal.cc' that could allow specially crafted HTTP requests that could result in a denial of service

ID	Name	Product	Family	Severity
93294	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:2089-1)	Nessus	SuSE Local Security Checks	high
93271	SUSE SLES11 Security Update : squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	high
78658	Amazon Linux AMI : squid (ALAS-2014-433)	Nessus	Amazon Linux Local Security Checks	high
78354	Amazon Linux AMI : squid (ALAS-2014-411)	Nessus	Amazon Linux Local Security Checks	high
77553	Scientific Linux Security Update : squid on SL5.x, SL6.x i386/x86_64 (20140903)	Nessus	Scientific Linux Local Security Checks	high
77523	RHEL 5 / 6 : squid (RHSA-2014:1148)	Nessus	Red Hat Local Security Checks	high
77517	Oracle Linux 5 / 6 : squid (ELSA-2014-1148)	Nessus	Oracle Linux Local Security Checks	high
77509	CentOS 5 / 6 : squid (CESA-2014:1148)	Nessus	CentOS Local Security Checks	high
75142	openSUSE Security Update : squid3 (openSUSE-SU-2013:1441-1)	Nessus	SuSE Local Security Checks	high
75140	openSUSE Security Update : squid (openSUSE-SU-2013:1435-1)	Nessus	SuSE Local Security Checks	high
75139	openSUSE Security Update : squid (openSUSE-SU-2013:1436-1)	Nessus	SuSE Local Security Checks	high
70182	GLSA-201309-22 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
70021	SuSE 11.2 / 11.3 Security Update : squid (SAT Patch Numbers 8309 / 8310)	Nessus	SuSE Local Security Checks	high
69204	Fedora 18 : squid-3.2.13-1.fc18 (2013-13493)	Nessus	Fedora Local Security Checks	high
69201	Fedora 19 : squid-3.2.13-1.fc19 (2013-13468)	Nessus	Fedora Local Security Checks	high
69067	Mandriva Linux Security Advisory : squid (MDVSA-2013:199)	Nessus	Mandriva Local Security Checks	high
69041	Squid 3.x < 3.2.12 / 3.3.x < 3.3.7 idnsALookup HTTP Request DoS	Nessus	Firewalls	high
6931	Squid 3.x < 3.2.12 / 3.3.x < 3.3.7 idnsALookup HTTP Request DoS	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2013-4115

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium